{ "statistics": { "processing": [ { "name": "CAPE", "time": 0.0 }, { "name": "AnalysisInfo", "time": 0.016 }, { "name": "BehaviorAnalysis", "time": 0.124 }, { "name": "Debug", "time": 0.001 }, { "name": "NetworkAnalysis", "time": 1.021 }, { "name": "UrlAnalysis", "time": 1.795 }, { "name": "script_log_processing", "time": 0.0 }, { "name": "ProcessMemory", "time": 0.0 } ], "signatures": [ { "name": "packer_themida", "time": 0.0 }, { "name": "stealth_network", "time": 0.0 }, { "name": "disable_driver_via_blocklist", "time": 0.0 }, { "name": "disable_driver_via_hvcidisallowedimages", "time": 0.0 }, { "name": "disable_hypervisor_protected_code_integrity", "time": 0.0 }, { "name": "pendingfilerenameoperations_Operations", "time": 0.0 }, { "name": "anomalous_deletefile", "time": 0.0 }, { "name": "antiav_360_libs", "time": 0.0 }, { "name": "antiav_ahnlab_libs", "time": 0.0 }, { "name": "antiav_avast_libs", "time": 0.0 }, { "name": "antiav_bitdefender_libs", "time": 0.0 }, { "name": "antiav_bullguard_libs", "time": 0.0 }, { "name": "antiav_emsisoft_libs", "time": 0.0 }, { "name": "antiav_qurb_libs", "time": 0.0 }, { "name": "antiav_servicestop", "time": 0.0 }, { "name": "antiav_apioverride_libs", "time": 0.0 }, { "name": "antidebug_guardpages", "time": 0.0 }, { "name": "antidebug_ntcreatethreadex", "time": 0.0 }, { "name": "antiav_nthookengine_libs", "time": 0.0 }, { "name": "antidebug_outputdebugstring", "time": 0.0 }, { "name": "antidebug_setunhandledexceptionfilter", "time": 0.0 }, { "name": "antidebug_windows", "time": 0.0 }, { "name": "antisandbox_cuckoo", "time": 0.0 }, { "name": "antisandbox_cuckoocrash", "time": 0.0 }, { "name": "antisandbox_foregroundwindows", "time": 0.0 }, { "name": "mouse_movement_detect", "time": 0.0 }, { "name": "antisandbox_sboxie_libs", "time": 0.0 }, { "name": "antisandbox_sboxie_objects", "time": 0.0 }, { "name": "antisandbox_script_timer", "time": 0.0 }, { "name": "antisandbox_sleep", "time": 0.0 }, { "name": "antisandbox_sunbelt_libs", "time": 0.0 }, { "name": "antisandbox_unhook", "time": 0.0 }, { "name": "hardware_id_profiling", "time": 0.0 }, { "name": "antivm_directory_objects", "time": 0.0 }, { "name": "antivm_display", "time": 0.0 }, { "name": "antivm_generic_disk", "time": 0.0 }, { "name": "antivm_generic_scsi", "time": 0.0 }, { "name": "antivm_generic_services", "time": 0.0 }, { "name": "antivm_generic_system", "time": 0.0 }, { "name": "antivm_checks_available_memory", "time": 0.0 }, { "name": "detect_virtualization_via_recent_files", "time": 0.0 }, { "name": "antivm_vbox_libs", "time": 0.0 }, { "name": "antivm_vbox_window", "time": 0.0 }, { "name": "antivm_vmware_events", "time": 0.0 }, { "name": "antivm_vmware_libs", "time": 0.0 }, { "name": "antivm_wmi", "time": 0.0 }, { "name": "api_spamming", "time": 0.0 }, { "name": "api_uuidfromstringa", "time": 0.0 }, { "name": "bcdedit_command", "time": 0.0 }, { "name": "bootkit", "time": 0.0 }, { "name": "direct_hdd_access", "time": 0.0 }, { "name": "physical_drive_access", "time": 0.0 }, { "name": "potential_overwrite_mbr", "time": 0.0 }, { "name": "read_file_raw_disk_access", "time": 0.0 }, { "name": "suspicious_iocontrol_codes", "time": 0.0 }, { "name": "browser_needed", "time": 0.0 }, { "name": "firefox_disables_process_tab", "time": 0.0 }, { "name": "amsi_enumeration", "time": 0.0 }, { "name": "regsvr32_squiblydoo_dll_load", "time": 0.0 }, { "name": "suspicious_ntdll_disk_load", "time": 0.0 }, { "name": "direct_syscall_evasion", "time": 0.0 }, { "name": "unbacked_syscall_execution", "time": 0.0 }, { "name": "uac_bypass_cmstp", "time": 0.0 }, { "name": "uac_bypass_eventvwr", "time": 0.0 }, { "name": "uac_bypass_windows_Backup", "time": 0.0 }, { "name": "privilege_elevation_check", "time": 0.0 }, { "name": "queries_computer_name", "time": 0.0 }, { "name": "queries_user_name", "time": 0.0 }, { "name": "creates_largekey", "time": 0.0 }, { "name": "creates_nullvalue", "time": 0.0 }, { "name": "access_windows_passwords_vault", "time": 0.0 }, { "name": "dump_lsa_via_windows_error_reporting", "time": 0.0 }, { "name": "lsass_credential_dumping", "time": 0.0 }, { "name": "critical_process", "time": 0.0 }, { "name": "query_fips_reconnaissance", "time": 0.0 }, { "name": "cryptopool_domains", "time": 0.0 }, { "name": "dead_connect", "time": 0.0 }, { "name": "dead_link", "time": 0.0 }, { "name": "debugs_self", "time": 0.0 }, { "name": "decoy_image", "time": 0.0 }, { "name": "deletes_consolehost_history", "time": 0.0 }, { "name": "deletes_shadow_copies", "time": 0.0 }, { "name": "deletes_system_state_backup", "time": 0.0 }, { "name": "dep_bypass", "time": 0.0 }, { "name": "dep_disable", "time": 0.0 }, { "name": "disables_mappeddrives_autodisconnect", "time": 0.0 }, { "name": "disables_spdy", "time": 0.0 }, { "name": "disables_wfp", "time": 0.0 }, { "name": "add_windows_defender_exclusions", "time": 0.0 }, { "name": "mountpoints_volume_discovery", "time": 0.0 }, { "name": "dll_load_uncommon_file_types", "time": 0.0 }, { "name": "dllload_suspicious_directory", "time": 0.0 }, { "name": "document_script_exe_drop", "time": 0.0 }, { "name": "driver_load", "time": 0.0 }, { "name": "install_kernel_driver_service", "time": 0.0 }, { "name": "malformed_dll_loading", "time": 0.0 }, { "name": "dynamic_function_loading", "time": 0.0 }, { "name": "registers_vectored_exception_handler", "time": 0.0 }, { "name": "exec_crash", "time": 0.0 }, { "name": "process_creation_suspicious_location", "time": 0.0 }, { "name": "exploit_getbasekerneladdress", "time": 0.0 }, { "name": "exploit_gethaldispatchtable", "time": 0.0 }, { "name": "exploit_heapspray", "time": 0.0 }, { "name": "downloads_from_filehosting", "time": 0.0 }, { "name": "generic_phish", "time": 0.0 }, { "name": "http_request", "time": 0.0 }, { "name": "infostealer_browser", "time": 0.0 }, { "name": "infostealer_browser_password", "time": 0.0 }, { "name": "infostealer_cookies", "time": 0.0 }, { "name": "captures_screenshot", "time": 0.0 }, { "name": "injection_createremotethread", "time": 0.0 }, { "name": "creates_suspended_process", "time": 0.0 }, { "name": "injection_explorer", "time": 0.0 }, { "name": "injection_module_stomping_probing", "time": 0.0 }, { "name": "injection_needextension", "time": 0.0 }, { "name": "injection_network_traffic", "time": 0.0 }, { "name": "injection_runpe", "time": 0.0 }, { "name": "section_mapping_injection", "time": 0.0 }, { "name": "injection_themeinitapihook", "time": 0.0 }, { "name": "apc_injection", "time": 0.0 }, { "name": "resumethread_remote_process", "time": 0.0 }, { "name": "injection_write_exe_process", "time": 0.0 }, { "name": "injection_write_process", "time": 0.0 }, { "name": "internet_dropper", "time": 0.0 }, { "name": "interprocess_comms_mutex", "time": 0.0 }, { "name": "interprocess_comms_named_pipe", "time": 0.0 }, { "name": "interprocess_comms_shared_memory", "time": 0.0 }, { "name": "escalate_privilege_via_named_pipe", "time": 0.0 }, { "name": "ipc_namedpipe", "time": 0.0 }, { "name": "js_phish", "time": 0.0 }, { "name": "js_suspicious_redirect", "time": 0.0 }, { "name": "execute_binary_via_internet_explorer_exporter", "time": 0.0 }, { "name": "execute_binary_via_run_exe_helper_utility", "time": 0.0 }, { "name": "execute_ps_via_syncappvpublishingserver", "time": 0.0 }, { "name": "malicious_dynamic_function_loading", "time": 0.0 }, { "name": "reads_memory_remote_process", "time": 0.0 }, { "name": "unbacked_exception_filter", "time": 0.0 }, { "name": "unbacked_process_mitigation_alteration", "time": 0.0 }, { "name": "thread_unbacked_memory", "time": 0.0 }, { "name": "unbacked_api_resolution", "time": 0.0 }, { "name": "unbacked_dotnet_execution", "time": 0.0 }, { "name": "unbacked_library_load", "time": 0.0 }, { "name": "unbacked_memory_apc_execution", "time": 0.0 }, { "name": "unbacked_memory_protection_alteration", "time": 0.0 }, { "name": "unbacked_mutex_creation", "time": 0.0 }, { "name": "unbacked_process_creation", "time": 0.0 }, { "name": "unbacked_veh_registration", "time": 0.0 }, { "name": "unbacked_com_instantiation", "time": 0.0 }, { "name": "unbacked_crypto_operations", "time": 0.0 }, { "name": "unbacked_delay_execution", "time": 0.0 }, { "name": "unbacked_file_dropping", "time": 0.0 }, { "name": "unbacked_process_enumeration", "time": 0.0 }, { "name": "unbacked_registry_modification", "time": 0.0 }, { "name": "unbacked_service_manipulation", "time": 0.0 }, { "name": "unbacked_token_manipulation", "time": 0.0 }, { "name": "unbacked_wmi_execution", "time": 0.0 }, { "name": "unbacked_bind_shell", "time": 0.0 }, { "name": "unbacked_dns_resolution", "time": 0.0 }, { "name": "unbacked_memory_network_connection", "time": 0.0 }, { "name": "unbacked_named_pipe_creation", "time": 0.0 }, { "name": "unbacked_useragent_retrieval", "time": 0.0 }, { "name": "mimics_filetime", "time": 0.0 }, { "name": "amsi_bypass_via_com_registry", "time": 0.0 }, { "name": "access_auto_logons_via_registry", "time": 0.0 }, { "name": "access_boot_key_via_registry", "time": 0.0 }, { "name": "create_suspicious_lnk_files", "time": 0.0 }, { "name": "credential_access_via_windows_credential_history", "time": 0.0 }, { "name": "dll_hijacking_via_microsoft_exchange", "time": 0.0 }, { "name": "dll_hijacking_via_waas_medic_svc_com_typelib", "time": 0.0 }, { "name": "execute_file_downloaded_via_openssh", "time": 0.0 }, { "name": "execute_safe_mode_from_suspicious_process", "time": 0.0 }, { "name": "execute_scripts_via_microsoft_management_console", "time": 0.0 }, { "name": "execute_suspicious_processes_via_windows_mssql_service", "time": 0.0 }, { "name": "execution_from_self_extracting_archive", "time": 0.0 }, { "name": "ip_address_discovery_via_trusted_program", "time": 0.0 }, { "name": "load_dll_via_control_panel", "time": 0.0 }, { "name": "network_connection_via_suspicious_process", "time": 0.0 }, { "name": "potential_location_discovery_via_unusual_process", "time": 0.0 }, { "name": "store_executable_registry", "time": 0.0 }, { "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent", "time": 0.0 }, { "name": "suspicious_java_execution_via_win_scripts", "time": 0.0 }, { "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File", "time": 0.0 }, { "name": "uses_restart_manager_for_suspicious_activities", "time": 0.0 }, { "name": "modify_desktop_wallpaper", "time": 0.0 }, { "name": "modify_zoneid_ads", "time": 0.0 }, { "name": "move_file_on_reboot", "time": 0.0 }, { "name": "multiple_useragents", "time": 0.0 }, { "name": "network_anomaly", "time": 0.0 }, { "name": "network_bind", "time": 0.0 }, { "name": "etherhiding_smart_contract_call", "time": 0.0 }, { "name": "network_cnc_https_archive", "time": 0.0 }, { "name": "network_cnc_https_free_webhosting", "time": 0.0 }, { "name": "network_cnc_https_generic", "time": 0.0 }, { "name": "network_cnc_https_interactsh", "time": 0.0 }, { "name": "network_cnc_https_opensource", "time": 0.0 }, { "name": "network_cnc_https_pastesite", "time": 0.0 }, { "name": "network_cnc_https_payload", "time": 0.0 }, { "name": "network_cnc_https_serviceinterface", "time": 0.0 }, { "name": "network_cnc_https_socialmedia", "time": 0.0 }, { "name": "network_cnc_https_telegram", "time": 0.0 }, { "name": "network_cnc_https_tempstorage", "time": 0.0 }, { "name": "network_cnc_https_temp_urldns", "time": 0.0 }, { "name": "network_cnc_https_urlshortener", "time": 0.0 }, { "name": "network_cnc_https_useragent", "time": 0.0 }, { "name": "network_cnc_smtps_exfil", "time": 0.0 }, { "name": "network_cnc_smtps_generic", "time": 0.0 }, { "name": "network_dns_idn", "time": 0.0 }, { "name": "network_dns_suspicious_querytype", "time": 0.0 }, { "name": "network_dns_tunneling_request", "time": 0.0 }, { "name": "explorer_http", "time": 0.0 }, { "name": "network_fake_useragent", "time": 0.0 }, { "name": "legitimate_domain_abuse", "time": 0.0 }, { "name": "suspicious_communication_trusted_site", "time": 0.0 }, { "name": "network_tor", "time": 0.0 }, { "name": "office_com_load", "time": 0.0 }, { "name": "office_dotnet_load", "time": 0.0 }, { "name": "office_mshtml_load", "time": 0.0 }, { "name": "office_vb_load", "time": 0.0 }, { "name": "office_wmi_load", "time": 0.0 }, { "name": "office_cve2017_11882_network", "time": 0.0 }, { "name": "office_cve_2021_40444", "time": 0.0 }, { "name": "office_cve_2021_40444_m2", "time": 0.0 }, { "name": "office_flash_load", "time": 0.0 }, { "name": "office_postscript", "time": 0.0 }, { "name": "office_suspicious_processes", "time": 0.0 }, { "name": "decompress_exe", "time": 0.0 }, { "name": "persistence_via_autodial_dll_registry", "time": 0.0 }, { "name": "persistence_autorun", "time": 0.0 }, { "name": "persistence_autorun_tasks", "time": 0.0 }, { "name": "persistence_bootexecute", "time": 0.0 }, { "name": "persistence_registry_script", "time": 0.0 }, { "name": "powershell_download", "time": 0.0 }, { "name": "powershell_request", "time": 0.0 }, { "name": "createtoolhelp32snapshot_module_enumeration", "time": 0.0 }, { "name": "enumerates_running_processes", "time": 0.0 }, { "name": "process_interest", "time": 0.0 }, { "name": "process_needed", "time": 0.0 }, { "name": "ransomware_iocp_asynchronous_encryption", "time": 0.0 }, { "name": "kernel_crypto_driver_abuse", "time": 0.0 }, { "name": "mass_data_encryption", "time": 0.0 }, { "name": "ransomware_extension_hijack", "time": 0.0 }, { "name": "mass_file_modification_access", "time": 0.0 }, { "name": "ransomware_attribute_stripping", "time": 0.0 }, { "name": "ransomware_file_modifications", "time": 0.0 }, { "name": "mass_ransom_note_drop", "time": 0.0 }, { "name": "ransomware_message", "time": 0.0 }, { "name": "recon_beacon", "time": 0.0 }, { "name": "recon_programs", "time": 0.0 }, { "name": "recon_systeminfo", "time": 0.0 }, { "name": "accesses_recyclebin", "time": 0.0 }, { "name": "script_created_process", "time": 0.0 }, { "name": "script_network_activity", "time": 0.0 }, { "name": "suspicious_js_script", "time": 0.0 }, { "name": "javascript_timer", "time": 0.0 }, { "name": "secure_login_phishing", "time": 0.0 }, { "name": "securityxploded_modules", "time": 0.0 }, { "name": "get_clipboard_data", "time": 0.0 }, { "name": "sets_autoconfig_url", "time": 0.0 }, { "name": "spoofs_procname", "time": 0.0 }, { "name": "stack_pivot", "time": 0.0 }, { "name": "stack_pivot_file_created", "time": 0.0 }, { "name": "stack_pivot_process_create", "time": 0.0 }, { "name": "set_clipboard_data", "time": 0.0 }, { "name": "stealth_childproc", "time": 0.0 }, { "name": "stealth_system_procname", "time": 0.0 }, { "name": "stealth_timeout", "time": 0.0 }, { "name": "stealth_window", "time": 0.0 }, { "name": "queries_keyboard_layout", "time": 0.0 }, { "name": "queries_locale_api", "time": 0.0 }, { "name": "terminates_remote_process", "time": 0.0 }, { "name": "uiautomationcore_load", "time": 0.0 }, { "name": "user_enum", "time": 0.0 }, { "name": "mmc_dll_script_load", "time": 0.0 }, { "name": "mmc_dotnet_load", "time": 0.0 }, { "name": "virus", "time": 0.0 }, { "name": "webmail_phish", "time": 0.0 }, { "name": "persists_dev_util", "time": 0.0 }, { "name": "spawns_dev_util", "time": 0.0 }, { "name": "alters_windows_utility", "time": 0.0 }, { "name": "overwrites_accessibility_utility", "time": 0.0 }, { "name": "Potential_Lateral_Movement_Via_SMBEXEC", "time": 0.0 }, { "name": "potential_WebShell_Via_ScreenConnectServer", "time": 0.0 }, { "name": "uses_Microsoft_HTML_Help_Executable", "time": 0.0 }, { "name": "wiper_zeroedbytes", "time": 0.0 }, { "name": "wmi_create_process", "time": 0.0 }, { "name": "wmi_script_process", "time": 0.0 }, { "name": "deletes_files", "time": 0.0 }, { "name": "drops_files", "time": 0.0 }, { "name": "reads_files", "time": 0.0 }, { "name": "writes_files", "time": 0.0 }, { "name": "antianalysis_tls_section", "time": 0.0 }, { "name": "antivirus_clamav", "time": 0.0 }, { "name": "antivirus_virustotal", "time": 0.0 }, { "name": "bad_certs", "time": 0.0 }, { "name": "bad_ssl_certs", "time": 0.0 }, { "name": "banker_zeus_p2p", "time": 0.0 }, { "name": "banker_zeus_url", "time": 0.0 }, { "name": "bot_athenahttp", "time": 0.0 }, { "name": "bot_dirtjumper", "time": 0.0 }, { "name": "bot_drive", "time": 0.0 }, { "name": "bot_drive2", "time": 0.0 }, { "name": "bot_madness", "time": 0.0 }, { "name": "byod_loldrivers_match", "time": 0.0 }, { "name": "byod_novel_driver", "time": 0.0 }, { "name": "byod_post_load_exploitation", "time": 0.0 }, { "name": "byod_driver_service_install", "time": 0.0 }, { "name": "com_spawned_process", "time": 0.0 }, { "name": "family_proxyback", "time": 0.0 }, { "name": "flare_capa_antianalysis", "time": 0.0 }, { "name": "flare_capa_collection", "time": 0.0 }, { "name": "flare_capa_communication", "time": 0.0 }, { "name": "flare_capa_compiler", "time": 0.0 }, { "name": "flare_capa_datamanipulation", "time": 0.0 }, { "name": "flare_capa_executable", "time": 0.0 }, { "name": "flare_capa_hostinteraction", "time": 0.0 }, { "name": "flare_capa_impact", "time": 0.0 }, { "name": "flare_capa_lib", "time": 0.0 }, { "name": "flare_capa_linking", "time": 0.0 }, { "name": "flare_capa_loadcode", "time": 0.0 }, { "name": "flare_capa_malwarefamily", "time": 0.0 }, { "name": "flare_capa_nursery", "time": 0.0 }, { "name": "flare_capa_persistence", "time": 0.0 }, { "name": "flare_capa_runtime", "time": 0.0 }, { "name": "flare_capa_targeting", "time": 0.0 }, { "name": "threatfox", "time": 0.0 }, { "name": "log4shell", "time": 0.0 }, { "name": "mimics_extension", "time": 0.0 }, { "name": "network_ip_exe", "time": 0.0 }, { "name": "network_dga", "time": 0.0 }, { "name": "network_dga_fraunhofer", "time": 0.0 }, { "name": "network_dyndns", "time": 0.001 }, { "name": "network_icmp", "time": 0.0 }, { "name": "network_irc", "time": 0.0 }, { "name": "network_open_proxy", "time": 0.0 }, { "name": "network_smtp", "time": 0.0 }, { "name": "network_torgateway", "time": 0.001 }, { "name": "origin_langid", "time": 0.0 }, { "name": "origin_resource_langid", "time": 0.0 }, { "name": "overlay", "time": 0.0 }, { "name": "pe_deep_entrypoint", "time": 0.0 }, { "name": "packer_unknown_pe_section_name", "time": 0.0 }, { "name": "packer_aspack", "time": 0.0 }, { "name": "packer_aspirecrypt", "time": 0.0 }, { "name": "packer_bedsprotector", "time": 0.0 }, { "name": "packer_confuser", "time": 0.0 }, { "name": "packer_enigma", "time": 0.0 }, { "name": "packer_entropy", "time": 0.0 }, { "name": "packer_mpress", "time": 0.0 }, { "name": "packer_nate", "time": 0.0 }, { "name": "packer_nspack", "time": 0.0 }, { "name": "packer_smartassembly", "time": 0.0 }, { "name": "packer_spices", "time": 0.0 }, { "name": "packer_themida", "time": 0.0 }, { "name": "packer_titan", "time": 0.0 }, { "name": "packer_upx", "time": 0.0 }, { "name": "packer_vmprotect", "time": 0.0 }, { "name": "packer_yoda", "time": 0.0 }, { "name": "pe_cert_invalid_signature", "time": 0.0 }, { "name": "pe_cert_self_signed", "time": 0.0 }, { "name": "pe_cert_suspicious_issuer", "time": 0.0 }, { "name": "punch_plus_plus_pcres", "time": 0.0 }, { "name": "procmem_yara", "time": 0.0 }, { "name": "recon_checkip", "time": 0.0 }, { "name": "sigma_events", "time": 0.0 }, { "name": "static_authenticode", "time": 0.0 }, { "name": "invalid_authenticode_signature", "time": 0.0 }, { "name": "static_dotnet_anomaly", "time": 0.0 }, { "name": "static_java", "time": 0.0 }, { "name": "static_pdf", "time": 0.0 }, { "name": "contains_pe_overlay", "time": 0.0 }, { "name": "static_pe_anomaly", "time": 0.0 }, { "name": "pe_compile_timestomping", "time": 0.0 }, { "name": "static_pe_pdbpath", "time": 0.0 }, { "name": "static_rat_config", "time": 0.0 }, { "name": "static_versioninfo_anomaly", "time": 0.0 }, { "name": "browser_credential_theft_headless", "time": 0.0 }, { "name": "suricata_alert", "time": 0.0 }, { "name": "volatility_devicetree_1", "time": 0.0 }, { "name": "volatility_handles_1", "time": 0.0 }, { "name": "volatility_ldrmodules_1", "time": 0.0 }, { "name": "volatility_ldrmodules_2", "time": 0.0 }, { "name": "volatility_malfind_1", "time": 0.0 }, { "name": "volatility_malfind_2", "time": 0.0 }, { "name": "volatility_modscan_1", "time": 0.0 }, { "name": "volatility_svcscan_1", "time": 0.0 }, { "name": "volatility_svcscan_2", "time": 0.0 }, { "name": "volatility_svcscan_3", "time": 0.0 }, { "name": "whois_create", "time": 0.0 }, { "name": "accesses_mailslot", "time": 0.0 }, { "name": "accesses_netlogon_regkey", "time": 0.0 }, { "name": "accesses_public_folder", "time": 0.0 }, { "name": "accesses_sysvol", "time": 0.0 }, { "name": "writes_sysvol", "time": 0.0 }, { "name": "adds_admin_user", "time": 0.0 }, { "name": "adds_user", "time": 0.0 }, { "name": "overwrites_admin_password", "time": 0.0 }, { "name": "antianalysis_detectfile", "time": 0.001 }, { "name": "antianalysis_detectreg", "time": 0.033 }, { "name": "modify_attachment_manager", "time": 0.0 }, { "name": "antiav_detectfile", "time": 0.002 }, { "name": "antiav_detectreg", "time": 0.16 }, { "name": "antiav_srp", "time": 0.0 }, { "name": "antiav_whitespace", "time": 0.0 }, { "name": "antidebug_devices", "time": 0.0 }, { "name": "antiemu_windefend", "time": 0.0 }, { "name": "antiemu_wine_reg", "time": 0.0 }, { "name": "antisandbox_cuckoo_files", "time": 0.0 }, { "name": "antisandbox_fortinet_files", "time": 0.0 }, { "name": "antisandbox_joe_anubis_files", "time": 0.0 }, { "name": "antisandbox_sboxie_mutex", "time": 0.0 }, { "name": "antisandbox_sunbelt_files", "time": 0.0 }, { "name": "antisandbox_threattrack_files", "time": 0.0 }, { "name": "antivm_bochs_keys", "time": 0.003 }, { "name": "antivm_generic_bios", "time": 0.002 }, { "name": "antivm_generic_diskreg", "time": 0.006 }, { "name": "antivm_hyperv_keys", "time": 0.003 }, { "name": "antivm_parallels_keys", "time": 0.009 }, { "name": "antivm_recentdocs", "time": 0.0 }, { "name": "antivm_vbox_devices", "time": 0.0 }, { "name": "antivm_vbox_files", "time": 0.001 }, { "name": "antivm_vbox_keys", "time": 0.018 }, { "name": "antivm_vmware_devices", "time": 0.0 }, { "name": "antivm_vmware_files", "time": 0.0 }, { "name": "antivm_vmware_keys", "time": 0.012 }, { "name": "antivm_vmware_mutexes", "time": 0.0 }, { "name": "antivm_vpc_files", "time": 0.0 }, { "name": "antivm_vpc_keys", "time": 0.006 }, { "name": "antivm_vpc_mutex", "time": 0.0 }, { "name": "antivm_xen_keys", "time": 0.009 }, { "name": "ketrican_regkeys", "time": 0.002 }, { "name": "bitcoin_opencl", "time": 0.0 }, { "name": "enumerates_physical_drives", "time": 0.0 }, { "name": "bot_russkill", "time": 0.0 }, { "name": "browser_addon", "time": 0.0 }, { "name": "chromium_browser_extension_directory", "time": 0.0 }, { "name": "browser_helper_object", "time": 0.0 }, { "name": "browser_security", "time": 0.0 }, { "name": "browser_startpage", "time": 0.0 }, { "name": "executes_headless_browser", "time": 0.0 }, { "name": "suspicious_browser_arguments", "time": 0.0 }, { "name": "ie_disables_process_tab", "time": 0.0 }, { "name": "odbcconf_bypass", "time": 0.003 }, { "name": "squiblydoo_bypass", "time": 0.0 }, { "name": "squiblytwo_bypass", "time": 0.0 }, { "name": "bypass_chromium_protection", "time": 0.0 }, { "name": "bypass_firewall", "time": 0.003 }, { "name": "checks_uac_status", "time": 0.0 }, { "name": "uac_bypass_cmstpcom", "time": 0.001 }, { "name": "uac_bypass_delegateexecute_sdclt", "time": 0.0 }, { "name": "uac_bypass_fodhelper", "time": 0.0 }, { "name": "cape_extracted_content", "time": 0.0 }, { "name": "clears_logs", "time": 0.0 }, { "name": "cmdline_obfuscation", "time": 0.0 }, { "name": "cmdline_switches", "time": 0.0 }, { "name": "cmdline_terminate", "time": 0.0 }, { "name": "cmdline_forfiles_wildcard", "time": 0.0 }, { "name": "cmdline_http_link", "time": 0.0 }, { "name": "cmdline_long_string", "time": 0.0 }, { "name": "cmdline_reversed_http_link", "time": 0.0 }, { "name": "long_commandline", "time": 0.0 }, { "name": "powershell_renamed_commandline", "time": 0.0 }, { "name": "copies_self", "time": 0.0 }, { "name": "credwiz_credentialaccess", "time": 0.0 }, { "name": "enables_wdigest", "time": 0.0 }, { "name": "vaultcmd_credentialaccess", "time": 0.0 }, { "name": "file_credential_store_access", "time": 0.0 }, { "name": "file_credential_store_write", "time": 0.0 }, { "name": "kerberos_credential_access_via_rubeus", "time": 0.0 }, { "name": "registry_credential_dumping", "time": 0.0 }, { "name": "registry_lsa_secrets_access", "time": 0.0 }, { "name": "comsvcs_credentialdump", "time": 0.0 }, { "name": "cryptomining_stratum_command", "time": 0.0 }, { "name": "deepfreeze_mutex", "time": 0.0 }, { "name": "deletes_executed_files", "time": 0.0 }, { "name": "disables_app_launch", "time": 0.0 }, { "name": "disables_auto_app_termination", "time": 0.0 }, { "name": "disables_appv_virtualization", "time": 0.0 }, { "name": "disables_backups", "time": 0.0 }, { "name": "disables_browser_warn", "time": 0.0 }, { "name": "disables_context_menus", "time": 0.0 }, { "name": "disables_cpl_disable", "time": 0.0 }, { "name": "disables_crashdumps", "time": 0.0 }, { "name": "disables_event_logging", "time": 0.0 }, { "name": "disables_folder_options", "time": 0.0 }, { "name": "disables_notificationcenter", "time": 0.0 }, { "name": "disables_power_options", "time": 0.0 }, { "name": "disables_restore_default_state", "time": 0.0 }, { "name": "disables_run_command", "time": 0.0 }, { "name": "disables_smartscreen", "time": 0.0 }, { "name": "disables_startmenu_search", "time": 0.0 }, { "name": "disables_system_restore", "time": 0.0 }, { "name": "disables_uac", "time": 0.0 }, { "name": "disables_wer", "time": 0.0 }, { "name": "disables_windows_defender", "time": 0.0 }, { "name": "disables_windows_defender_logging", "time": 0.002 }, { "name": "removes_windows_defender_contextmenu", "time": 0.002 }, { "name": "removes_windows_defender_updates", "time": 0.0 }, { "name": "windows_defender_powershell", "time": 0.0 }, { "name": "disables_windows_file_protection", "time": 0.0 }, { "name": "disables_windowsupdate", "time": 0.0 }, { "name": "disables_winfirewall", "time": 0.0 }, { "name": "folder_enumeration", "time": 0.0 }, { "name": "discover_registry_mount_points", "time": 0.0 }, { "name": "adfind_domain_enumeration", "time": 0.0 }, { "name": "domain_enumeration_commands", "time": 0.0 }, { "name": "driver_filtermanager", "time": 0.0 }, { "name": "dropper", "time": 0.0 }, { "name": "dll_archive_execution", "time": 0.0 }, { "name": "lnk_archive_execution", "time": 0.0 }, { "name": "script_archive_execution", "time": 0.0 }, { "name": "excel4_macro_urls", "time": 0.0 }, { "name": "escalate_privilege_via_ntlm_relay", "time": 0.0 }, { "name": "spooler_access", "time": 0.0 }, { "name": "spooler_svc_start", "time": 0.0 }, { "name": "mapped_drives_uac", "time": 0.0 }, { "name": "hides_recycle_bin_icon", "time": 0.0 }, { "name": "infostealer_bitcoin", "time": 0.001 }, { "name": "infostealer_ftp", "time": 0.055 }, { "name": "infostealer_im", "time": 0.03 }, { "name": "infostealer_mail", "time": 0.006 }, { "name": "Evade_Execution_Via_ASPNet_Compiler", "time": 0.0 }, { "name": "Evade_Execute_Via_DeviceCredentialDeployment", "time": 0.0 }, { "name": "Evade_Execution_Via_Filter_Manager_Control", "time": 0.0 }, { "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper", "time": 0.0 }, { "name": "execute_binary_via_appvlp", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_OpenSSH", "time": 0.0 }, { "name": "execute_binary_via_pcalua", "time": 0.0 }, { "name": "Execute_Binary_Via_PesterPSModule", "time": 0.0 }, { "name": "Execute_Binary_Via_ScriptRunner", "time": 0.0 }, { "name": "execute_binary_via_ttdinject", "time": 0.0 }, { "name": "Execute_Binary_Via_VisualStudioLiveShare", "time": 0.0 }, { "name": "Execute_Msiexec_Via_Explorer", "time": 0.0 }, { "name": "execute_remote_msi", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_runscripthelper", "time": 0.0 }, { "name": "execute_suspicious_powershell_via_sqlps", "time": 0.0 }, { "name": "Indirect_Command_Execution_Via_ConsoleWindowHost", "time": 0.0 }, { "name": "Perform_Malicious_Activities_Via_Headless_Browser", "time": 0.0 }, { "name": "Register_DLL_Via_CertOC", "time": 0.0 }, { "name": "Register_DLL_Via_MSIEXEC", "time": 0.0 }, { "name": "Register_DLL_Via_Odbcconf", "time": 0.0 }, { "name": "Scriptlet_Proxy_Execution_Via_Pubprn", "time": 0.0 }, { "name": "ie_martian_children", "time": 0.0 }, { "name": "office_martian_children", "time": 0.0 }, { "name": "mimics_icon", "time": 0.0 }, { "name": "masquerade_process_name", "time": 0.002 }, { "name": "mimikatz_modules", "time": 0.0 }, { "name": "ms_office_cmd_rce", "time": 0.0 }, { "name": "mount_copy_to_webdav_share", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_legit_utilities", "time": 0.0 }, { "name": "potential_protocol_tunneling_via_qemu", "time": 0.0 }, { "name": "suspicious_execution_via_dotnet_remoting", "time": 0.0 }, { "name": "dotnet_clr_usagelog_regkeys", "time": 0.0 }, { "name": "modify_hostfile", "time": 0.0 }, { "name": "modify_oem_information", "time": 0.0 }, { "name": "modify_security_center_warnings", "time": 0.0 }, { "name": "modify_uac_prompt", "time": 0.0 }, { "name": "network_dns_blockchain", "time": 0.0 }, { "name": "network_dns_opennic", "time": 0.0 }, { "name": "network_dns_paste_site", "time": 0.0 }, { "name": "network_dns_reverse_proxy", "time": 0.0 }, { "name": "network_dns_temp_file_storage", "time": 0.0 }, { "name": "network_dns_temp_urldns", "time": 0.0 }, { "name": "network_dns_url_shortener", "time": 0.003 }, { "name": "network_dns_doh_tls", "time": 0.0 }, { "name": "suspicious_tld", "time": 0.003 }, { "name": "network_tor_service", "time": 0.0 }, { "name": "office_code_page", "time": 0.0 }, { "name": "office_addinloading", "time": 0.0 }, { "name": "office_perfkey", "time": 0.0 }, { "name": "office_macro", "time": 0.0 }, { "name": "changes_trust_center_settings", "time": 0.0 }, { "name": "disables_vba_trust_access", "time": 0.0 }, { "name": "office_macro_autoexecution", "time": 0.0 }, { "name": "office_macro_ioc", "time": 0.0 }, { "name": "office_macro_malicious_prediction", "time": 0.0 }, { "name": "office_macro_suspicious", "time": 0.0 }, { "name": "rtf_aslr_bypass", "time": 0.0 }, { "name": "rtf_anomaly_characterset", "time": 0.0 }, { "name": "rtf_anomaly_version", "time": 0.0 }, { "name": "rtf_embedded_content", "time": 0.0 }, { "name": "rtf_embedded_office_file", "time": 0.0 }, { "name": "rtf_exploit_static", "time": 0.0 }, { "name": "office_security", "time": 0.0 }, { "name": "accesses_office_username", "time": 0.0 }, { "name": "office_anomalous_feature", "time": 0.0 }, { "name": "office_dde_command", "time": 0.0 }, { "name": "packer_armadillo_mutex", "time": 0.0 }, { "name": "packer_armadillo_regkey", "time": 0.0 }, { "name": "persistence_ads", "time": 0.0 }, { "name": "persistence_safeboot", "time": 0.0 }, { "name": "persistence_ifeo", "time": 0.0 }, { "name": "persistence_silent_process_exit", "time": 0.0 }, { "name": "persistence_rdp_registry", "time": 0.0 }, { "name": "persistence_rdp_shadowing", "time": 0.0 }, { "name": "persistence_service", "time": 0.0 }, { "name": "persistence_shim_database", "time": 0.0 }, { "name": "powershell_scriptblock_logging", "time": 0.0 }, { "name": "powershell_command_suspicious", "time": 0.0 }, { "name": "powershell_history_save_mod", "time": 0.0 }, { "name": "powershell_renamed", "time": 0.0 }, { "name": "powershell_reversed", "time": 0.0 }, { "name": "powershell_variable_obfuscation", "time": 0.0 }, { "name": "prevents_safeboot", "time": 0.0 }, { "name": "cmdline_process_discovery", "time": 0.0 }, { "name": "ransomware_extensions_generic", "time": 0.0 }, { "name": "ransomware_extensions_known", "time": 0.001 }, { "name": "ransomware_files", "time": 0.002 }, { "name": "ransomware_recyclebin", "time": 0.0 }, { "name": "ransomware_revil_regkey", "time": 0.0 }, { "name": "reads_password_database", "time": 0.0 }, { "name": "recon_fingerprint", "time": 0.002 }, { "name": "rdptcp_key", "time": 0.0 }, { "name": "uses_rdp_clip", "time": 0.0 }, { "name": "uses_remote_desktop_session", "time": 0.0 }, { "name": "removes_networking_icon", "time": 0.0 }, { "name": "removes_pinned_programs", "time": 0.0 }, { "name": "removes_security_maintenance_icon", "time": 0.0 }, { "name": "removes_startmenu_defaults", "time": 0.0 }, { "name": "removes_username_startmenu", "time": 0.0 }, { "name": "sniffer_winpcap", "time": 0.0 }, { "name": "spreading_autoruninf", "time": 0.0 }, { "name": "stealth_hidden_extension", "time": 0.0 }, { "name": "stealth_hiddenreg", "time": 0.0 }, { "name": "stealth_hide_notifications", "time": 0.0 }, { "name": "stealth_webhistory", "time": 0.0 }, { "name": "sysinternals_psexec", "time": 0.0 }, { "name": "sysinternals_tools", "time": 0.0 }, { "name": "language_check_registry", "time": 0.0 }, { "name": "tampers_etw", "time": 0.0 }, { "name": "lsa_tampering", "time": 0.0 }, { "name": "tampers_powershell_logging", "time": 0.0 }, { "name": "territorial_disputes_sigs", "time": 0.051 }, { "name": "uses_adfind", "time": 0.0 }, { "name": "uses_ms_protocol", "time": 0.0 }, { "name": "owa_web_shell_files", "time": 0.0 }, { "name": "web_shell_files", "time": 0.0 }, { "name": "web_shell_processes", "time": 0.0 }, { "name": "dotnet_csc_build", "time": 0.0 }, { "name": "mavinject_lolbin", "time": 0.0 }, { "name": "multiple_explorer_instances", "time": 0.0 }, { "name": "script_tool_executed", "time": 0.0 }, { "name": "suspicious_certutil_use", "time": 0.0 }, { "name": "suspicious_command_tools", "time": 0.007 }, { "name": "suspicious_mpcmdrun_use", "time": 0.0 }, { "name": "suspicious_ping_use", "time": 0.0 }, { "name": "uses_powershell_copyitem", "time": 0.0 }, { "name": "uses_windows_utilities", "time": 0.008 }, { "name": "uses_windows_utilities_appcmd", "time": 0.0 }, { "name": "uses_windows_utilities_csvde_ldifde", "time": 0.0 }, { "name": "uses_windows_utilities_cipher", "time": 0.0 }, { "name": "uses_windows_utilities_clickonce", "time": 0.0 }, { "name": "uses_windows_utilities_curl", "time": 0.0 }, { "name": "uses_windows_utilities_dsquery", "time": 0.0 }, { "name": "uses_windows_utilities_esentutl", "time": 0.0 }, { "name": "uses_windows_utilities_finger", "time": 0.0 }, { "name": "uses_windows_utilities_mode", "time": 0.0 }, { "name": "uses_windows_utilities_ntdsutil", "time": 0.0 }, { "name": "uses_windows_utilities_nltest", "time": 0.0 }, { "name": "uses_windows_utilities_setx", "time": 0.0 }, { "name": "uses_windows_utilities_xcopy", "time": 0.0 }, { "name": "wmic_command_suspicious", "time": 0.0 }, { "name": "scrcons_wmi_script_consumer", "time": 0.0 } ], "reporting": [ { "name": "BinGraph", "time": 0.0 } ] }, "CAPE": { "payloads": [], "configs": [] }, "info": { "version": "2.5", "started": "2026-05-28 21:18:45", "ended": "2026-05-28 21:20:05", "duration": 80, "id": 35, "category": "url", "custom": "", "machine": { "id": 31, "status": "stopping", "name": "cuckoo1", "label": "cuckoo1", "platform": "windows", "manager": "KVM", "started_on": "2026-05-28 21:18:45", "shutdown_on": "2026-05-28 21:20:05" }, "package": "edge", "timeout": true, "tlp": null, "parent_sample": null, "options": { "vnc_port": "5910" }, "source_url": null, "route": "none", "user_id": 1, "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2" }, "behavior": { "processes": [ { "process_id": 4132, "process_name": "msedge.exe", "parent_id": 4484, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "first_seen": "2026-05-29 01:19:01,492", "calls": [ { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\version" }, { "name": "DllBase", "value": "0x7fff43500000" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SHCORE" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:19:01,538", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINMM" }, { "name": "DllBase", "value": "0x7fff453c0000" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x7ffefe540000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\KBDUS" }, { "name": "DllBase", "value": "0x7fff45010000" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "5592", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "ThreadHandle", "value": "0x0000036c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff17a95d58,0x7fff17a95d64,0x7fff17a95d70" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4748" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:19:01,679", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "5592", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff599d7d70", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff17a95d58,0x7fff17a95d64,0x7fff17a95d70" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4748" }, { "name": "ThreadId", "value": "4948" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "ThreadHandle", "value": "0x0000036c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings" }, { "name": "DllBase", "value": "0x7fff4d260000" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\gpapi" }, { "name": "DllBase", "value": "0x7fff55ec0000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wkscli" }, { "name": "DllBase", "value": "0x7fff56750000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netutils" }, { "name": "DllBase", "value": "0x7fff56a30000" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff19b60000" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff15300000" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff19b20000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MDMRegistration" }, { "name": "DllBase", "value": "0x7fff19b60000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\omadmapi" }, { "name": "DllBase", "value": "0x7fff19b20000" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils" }, { "name": "DllBase", "value": "0x7fff15300000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:19:01,695", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\profapi" }, { "name": "DllBase", "value": "0x7fff57560000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\netapi32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DSREG" }, { "name": "DllBase", "value": "0x7fff52f20000" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\cryptsp" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "5708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AssignedAccessRuntime" }, { "name": "DllBase", "value": "0x7fff4d010000" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7fff58380000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "5708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SystemSettings.DataModel" }, { "name": "DllBase", "value": "0x7fff4d3d0000" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\powrprof" }, { "name": "DllBase", "value": "0x7fff57490000" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\UMPDC" }, { "name": "DllBase", "value": "0x7fff57470000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DWrite" }, { "name": "DllBase", "value": "0x7fff49a90000" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:19:01,710", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32" }, { "name": "DllBase", "value": "0x7fff44d50000" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DPAPI" }, { "name": "DllBase", "value": "0x7fff57350000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "3388", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI" }, { "name": "DllBase", "value": "0x7fff569f0000" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\NLAapi" }, { "name": "DllBase", "value": "0x7fff52960000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\NSI" }, { "name": "DllBase", "value": "0x7fff58b20000" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6" }, { "name": "DllBase", "value": "0x7fff515c0000" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "6220", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc" }, { "name": "DllBase", "value": "0x7fff515a0000" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "5876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StructuredQuery" }, { "name": "DllBase", "value": "0x7fff4b070000" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DNSAPI" }, { "name": "DllBase", "value": "0x7fff56a40000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "5876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\PROPSYS" }, { "name": "DllBase", "value": "0x7fff52860000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "7272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreMessaging" }, { "name": "DllBase", "value": "0x7fff54850000" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CoreUIComponents" }, { "name": "DllBase", "value": "0x7fff54170000" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:19:01,726", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\textinputframework" }, { "name": "DllBase", "value": "0x7fff4b680000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "5876", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Windows.Storage.Search" }, { "name": "DllBase", "value": "0x7fff4cd70000" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\twinapi" }, { "name": "DllBase", "value": "0x7fff45580000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "7272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wevtapi" }, { "name": "DllBase", "value": "0x7fff52420000" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "3388", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\edputil" }, { "name": "DllBase", "value": "0x7fff47ab0000" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WindowManagementAPI" }, { "name": "DllBase", "value": "0x7fff51a60000" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\InputHost" }, { "name": "DllBase", "value": "0x7fff4af10000" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI" }, { "name": "DllBase", "value": "0x7fff4bfb0000" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "5992", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WTSAPI32" }, { "name": "DllBase", "value": "0x7fff52b00000" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:19:01,742", "thread_id": "5708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\iertutil" }, { "name": "DllBase", "value": "0x7fff4d6a0000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Web" }, { "name": "DllBase", "value": "0x7fff47980000" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5992", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINSTA" }, { "name": "DllBase", "value": "0x7fff57360000" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient" }, { "name": "DllBase", "value": "0x7fff515e0000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\mscms" }, { "name": "DllBase", "value": "0x7fff51600000" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5708", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\WINHTTP" }, { "name": "DllBase", "value": "0x7fff52560000" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:19:01,757", "thread_id": "5852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth" }, { "name": "DllBase", "value": "0x7fff17040000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:19:01,773", "thread_id": "5852", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\Secur32" }, { "name": "DllBase", "value": "0x7fff48330000" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:19:01,773", "thread_id": "5348", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a24" }, { "name": "ThreadHandle", "value": "0x00000944" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2452,i,15093159467427093542,9469911486581750728,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2600 /prefetch:3" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "2916" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.UI.Immersive" }, { "name": "DllBase", "value": "0x7fff49d10000" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5348", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2452,i,15093159467427093542,9469911486581750728,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2600 /prefetch:3" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2916" }, { "name": "ThreadId", "value": "3288" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a24" }, { "name": "ThreadHandle", "value": "0x00000944" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000a50" }, { "name": "ThreadHandle", "value": "0x000009cc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2140,i,13971268289555839105,5024170361431510807,262144 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2292 /prefetch:2" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "5704" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2140,i,13971268289555839105,5024170361431510807,262144 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2292 /prefetch:2" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "5704" }, { "name": "ThreadId", "value": "5016" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000a50" }, { "name": "ThreadHandle", "value": "0x000009cc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5776", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sxs" }, { "name": "DllBase", "value": "0x7fff573c0000" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5924", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\LINKINFO" }, { "name": "DllBase", "value": "0x7fff43590000" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:19:01,788", "thread_id": "5560", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000b54" }, { "name": "ThreadHandle", "value": "0x00000af0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2772,i,7301802344932445960,9908392774046128039,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2752 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "4388" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:19:01,804", "thread_id": "5560", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2772,i,7301802344932445960,9908392774046128039,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2752 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "4388" }, { "name": "ThreadId", "value": "4636" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000b54" }, { "name": "ThreadHandle", "value": "0x00000af0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:19:01,804", "thread_id": "5776", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:19:01,804", "thread_id": "5776", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager" }, { "name": "DllBase", "value": "0x7fff409a0000" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:19:01,835", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dxgi" }, { "name": "DllBase", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:19:01,835", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\d3d11" }, { "name": "DllBase", "value": "0x7fff53070000" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:19:01,835", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dcomp" }, { "name": "DllBase", "value": "0x7fff538a0000" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:19:01,835", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\dataexchange" }, { "name": "DllBase", "value": "0x7fff43630000" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:19:01,867", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo" }, { "name": "DllBase", "value": "0x7fff3f8a0000" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:19:01,867", "thread_id": "5776", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\dwmapi" }, { "name": "DllBase", "value": "0x7fff55220000" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:19:01,867", "thread_id": "5852", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000efc" }, { "name": "ThreadHandle", "value": "0x00000ef8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185280180 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3588,i,352751729640999831,7241083857455090681,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2824 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "7928" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:19:01,867", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\OLEACC" }, { "name": "DllBase", "value": "0x7fff43990000" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:19:01,882", "thread_id": "5924", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f30" }, { "name": "ThreadHandle", "value": "0x00000f10" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185281736 --skip-read-main-dll --metrics-shmem-handle=3668,i,13641473871044752765,1587090757937272952,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2508 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "7460" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:19:01,882", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\directmanipulation" }, { "name": "DllBase", "value": "0x7fff488b0000" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:19:01,882", "thread_id": "5852", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185280180 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3588,i,352751729640999831,7241083857455090681,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2824 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7928" }, { "name": "ThreadId", "value": "8852" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000efc" }, { "name": "ThreadHandle", "value": "0x00000ef8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:19:01,882", "thread_id": "5924", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185281736 --skip-read-main-dll --metrics-shmem-handle=3668,i,13641473871044752765,1587090757937272952,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2508 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "7460" }, { "name": "ThreadId", "value": "7180" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000f30" }, { "name": "ThreadHandle", "value": "0x00000f10" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:19:01,929", "thread_id": "8468", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core" }, { "name": "DllBase", "value": "0x7fff456d0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:19:01,945", "thread_id": "3984", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff48780000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:19:01,960", "thread_id": "8868", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains" }, { "name": "DllBase", "value": "0x7fff181e0000" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:19:01,976", "thread_id": "6220", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\vaultcli" }, { "name": "DllBase", "value": "0x7fff3e730000" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:19:01,976", "thread_id": "7780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\VCRUNTIME140" }, { "name": "DllBase", "value": "0x7fff42bf0000" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:19:01,976", "thread_id": "7780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions" }, { "name": "DllBase", "value": "0x7fff4cfa0000" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:19:02,007", "thread_id": "400", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension" }, { "name": "DllBase", "value": "0x7fff18150000" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:19:02,023", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:19:02,023", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\CRYPTSP" }, { "name": "DllBase", "value": "0x7fff56ef0000" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:19:02,023", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\rsaenh" }, { "name": "DllBase", "value": "0x7fff56630000" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:19:03,226", "thread_id": "5212", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:19:03,695", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:19:03,695", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:19:03,695", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\policymanager" }, { "name": "DllBase", "value": "0x7fff522d0000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:19:03,695", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\msvcp110_win" }, { "name": "DllBase", "value": "0x7fff566c0000" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:19:06,882", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\SETUPAPI" }, { "name": "DllBase", "value": "0x7fff59a80000" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:19:06,898", "thread_id": "5924", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000014ec" }, { "name": "ThreadHandle", "value": "0x000014dc" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4968,i,2703826968512009090,10212290371382479832,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5220 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "1252" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:19:06,898", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\DEVOBJ" }, { "name": "DllBase", "value": "0x7fff572f0000" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:19:06,898", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000151c" }, { "name": "ThreadHandle", "value": "0x00001518" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5188,i,13859723405859082630,9305877728756642692,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5288 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "972" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:19:06,898", "thread_id": "5924", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4968,i,2703826968512009090,10212290371382479832,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5220 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "1252" }, { "name": "ThreadId", "value": "1060" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000014ec" }, { "name": "ThreadHandle", "value": "0x000014dc" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:19:06,898", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5188,i,13859723405859082630,9305877728756642692,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5288 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "972" }, { "name": "ThreadId", "value": "6280" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000151c" }, { "name": "ThreadHandle", "value": "0x00001518" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:19:06,913", "thread_id": "8792", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient" }, { "name": "DllBase", "value": "0x7fff140b0000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:19:06,929", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\netprofm" }, { "name": "DllBase", "value": "0x7fff54b30000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:19:06,929", "thread_id": "6024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg" }, { "name": "DllBase", "value": "0x7fff16bd0000" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:19:06,929", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "8792", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds" }, { "name": "DllBase", "value": "0x7fff13a50000" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\npmproxy" }, { "name": "DllBase", "value": "0x7fff4f560000" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\TenantRestrictionsPlugin" }, { "name": "DllBase", "value": "0x7fff3f6a0000" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "3092", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001730" }, { "name": "ThreadHandle", "value": "0x0000172c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "5384" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\FirewallAPI" }, { "name": "DllBase", "value": "0x7fff56250000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:19:06,945", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\fwbase" }, { "name": "DllBase", "value": "0x7fff561e0000" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:19:06,960", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration" }, { "name": "DllBase", "value": "0x7fff180d0000" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:19:06,960", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:19:06,960", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:19:06,960", "thread_id": "4952", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:19:07,288", "thread_id": "3092", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7fff501a0000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:19:07,288", "thread_id": "3092", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.staterepositorycore" }, { "name": "DllBase", "value": "0x7fff4cbd0000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:19:07,288", "thread_id": "3092", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017ac" }, { "name": "ThreadHandle", "value": "0x000017e8" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" }, { "name": "DllPath", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application;" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:19:07,351", "thread_id": "6024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7fff4f950000" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:19:07,351", "thread_id": "6024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\wlanapi" }, { "name": "DllBase", "value": "0x7fff4f950000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:19:07,351", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel" }, { "name": "DllBase", "value": "0x7fff457f0000" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:19:07,351", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\AppXDeploymentClient" }, { "name": "DllBase", "value": "0x7fff4f740000" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:19:07,382", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NETAPI32" }, { "name": "DllBase", "value": "0x7fff43550000" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ncrypt" }, { "name": "DllBase", "value": "0x7fff57010000" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\NTASN1" }, { "name": "DllBase", "value": "0x7fff56fd0000" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\PCPKsp" }, { "name": "DllBase", "value": "0x7fff50370000" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\imagehlp" }, { "name": "DllBase", "value": "0x7fff59ef0000" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\tbs" }, { "name": "DllBase", "value": "0x7fff4fa10000" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:19:07,398", "thread_id": "6032", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\ncryptprov" }, { "name": "DllBase", "value": "0x7fff45050000" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:19:07,460", "thread_id": "3092", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080400", "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8972" }, { "name": "ThreadId", "value": "8608" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000017ac" }, { "name": "ThreadHandle", "value": "0x000017e8" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:19:07,507", "thread_id": "6480", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mswsock" }, { "name": "DllBase", "value": "0x7fff56d00000" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:19:29,726", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000017bc" }, { "name": "ThreadHandle", "value": "0x00001888" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=213130873 --skip-read-main-dll --metrics-shmem-handle=6248,i,3255421910467508928,14061151991070598029,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5676 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "8828" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:19:29,726", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=213130873 --skip-read-main-dll --metrics-shmem-handle=6248,i,3255421910467508928,14061151991070598029,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5676 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8828" }, { "name": "ThreadId", "value": "8808" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000017bc" }, { "name": "ThreadHandle", "value": "0x00001888" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:19:30,757", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001530" }, { "name": "ThreadHandle", "value": "0x00001834" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=214159338 --skip-read-main-dll --metrics-shmem-handle=6524,i,11924266036566698167,15539547891894405667,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4680 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "9124" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:19:30,757", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=214159338 --skip-read-main-dll --metrics-shmem-handle=6524,i,11924266036566698167,15539547891894405667,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4680 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "9124" }, { "name": "ThreadId", "value": "9156" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001530" }, { "name": "ThreadHandle", "value": "0x00001834" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:19:31,695", "thread_id": "5860", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings" }, { "name": "DllBase", "value": "0x7fff3efa0000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:19:31,773", "thread_id": "5348", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f9666", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000f88" }, { "name": "ThreadHandle", "value": "0x00000f94" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6196,i,6479037369313746977,9159291806258192882,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4012 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "6148" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:19:31,773", "thread_id": "5348", "caller": "0x7fff577f9666", "parentcaller": "0x7fff57fccec4", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6196,i,6479037369313746977,9159291806258192882,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4012 /prefetch:8" }, { "name": "CreationFlags", "value": "0x00080000", "pretty_value": "EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "6148" }, { "name": "ThreadId", "value": "5096" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00000f88" }, { "name": "ThreadHandle", "value": "0x00000f94" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:19:57,132", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001628" }, { "name": "ThreadHandle", "value": "0x00001690" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=240536740 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6276,i,6845367754590566645,7399985378762200423,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5148 /prefetch:1" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "3348" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:19:57,132", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=240536740 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6276,i,6845367754590566645,7399985378762200423,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5148 /prefetch:1" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "3348" }, { "name": "ThreadId", "value": "6236" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001628" }, { "name": "ThreadHandle", "value": "0x00001690" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:20:01,757", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\sppc" }, { "name": "DllBase", "value": "0x7fff56140000" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:20:01,757", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\slc" }, { "name": "DllBase", "value": "0x7fff56170000" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:20:01,757", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\slwga" }, { "name": "DllBase", "value": "0x7fff4f220000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:20:01,773", "thread_id": "8940", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient" }, { "name": "DllBase", "value": "0x7fff4d360000" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:20:01,820", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000195c" }, { "name": "ThreadHandle", "value": "0x0000199c" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3960,i,10386633558955450950,13100030651159545818,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=1732 /prefetch:8" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "6460" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:20:01,820", "thread_id": "5708", "caller": "0x7ff7f5477d66", "parentcaller": "0x7ff7f54781c2", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" }, { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3960,i,10386633558955450950,13100030651159545818,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=1732 /prefetch:8" }, { "name": "CreationFlags", "value": "0x0008040c", "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "6460" }, { "name": "ThreadId", "value": "3832" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000195c" }, { "name": "ThreadHandle", "value": "0x0000199c" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:20:01,898", "thread_id": "2012", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CloudExperienceHostCommon" }, { "name": "DllBase", "value": "0x7fff17ef0000" } ], "repeated": 0, "id": 187 } ], "threads": [ "2012", "5592", "5708", "3388", "6220", "5876", "7272", "5992", "5852", "5348", "5776", "5924", "5560", "8468", "3984", "8868", "7780", "400", "5212", "6032", "8792", "4952", "6024", "3092", "6480", "5860", "8940" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7f5380000", "MainExeSize": "0x00505000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 8972, "process_name": "identity_helper.exe", "parent_id": 4132, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "first_seen": "2026-05-29 01:19:07,494", "calls": [ { "timestamp": "2026-05-29 01:19:07,650", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000060", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff17792a60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:19:07,681", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000010", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff177ec510" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:19:07,697", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000091", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff177c5c30" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:19:07,728", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000090", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff177ec590" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:19:07,744", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff1775efd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:19:07,775", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff59fbc295", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000050", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff177c1950" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780f156", "parentcaller": "0x7fff17810c0a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780faa7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780faa7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780faa7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780faa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780faa7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff17739070", "parentcaller": "0x7fff177c2c96", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptprimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff17739070", "parentcaller": "0x7fff177c2c96", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff17739070", "parentcaller": "0x7fff177c2c96", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff17739089", "parentcaller": "0x7fff177c2c96", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff177c3b9c", "parentcaller": "0x7fff177c3d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff177c3b9c", "parentcaller": "0x7fff177c3d77", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2ef9d3f30000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff177c3c18", "parentcaller": "0x7fff1773b8df", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2ef9d3f31000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:19:07,806", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1781006a", "parentcaller": "0x7fff17810c0a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x24641005890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17810077", "parentcaller": "0x7fff17810c0a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f6c7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f6c7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f6c7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bd3c0" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f6c7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f1d6", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f1d6", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f1d6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0f00" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f1d6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777c301", "parentcaller": "0x7fff177ffa72", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777c311", "parentcaller": "0x7fff177ffa72", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd5350" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f8f9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f8f9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f8f9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c7130" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f8f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f922", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57827f40" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f922", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f94b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780f94b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f94b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578155b0" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f94b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f974", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c0210" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f974", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f99d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5781d1a0" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f99d", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f9c6", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577dae80" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f9c6", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780f9ef", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bad90" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780f9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780f9ef", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780fa41", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fb27", "parentcaller": "0x7fff1780fa41", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780fa41", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bae60" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780fa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780fa41", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc58", "parentcaller": "0x7fff1780fa6a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57810070" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fbd7", "parentcaller": "0x7fff1780fa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1780fc08", "parentcaller": "0x7fff1780fa6a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff17abf000" }, { "name": "ModuleName", "value": "msedge_elf.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000098000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17787e31", "parentcaller": "0x7fff1770b049", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17787e31", "parentcaller": "0x7fff1770b049", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17787e4a", "parentcaller": "0x7fff1770b049", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17780e68", "parentcaller": "0x7fff17780dc8", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usp10.dll" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x9100009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777fbd4", "parentcaller": "0x7fff17780076", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xe8\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777fc42", "parentcaller": "0x7fff17780076", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777fcd6", "parentcaller": "0x7fff17780076", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777fce6", "parentcaller": "0x7fff17780076", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "IsWow64Process" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fcf980" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1778019b", "parentcaller": "0x7fff177803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177802c2", "parentcaller": "0x7fff17780346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "channel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177802c2", "parentcaller": "0x7fff17780346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "channel" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "stable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177803ea", "parentcaller": "0x7fff177808ef", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1778019b", "parentcaller": "0x7fff177803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177802c2", "parentcaller": "0x7fff17780346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "ap" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177803ea", "parentcaller": "0x7fff1778195d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1777feef", "parentcaller": "0x7fff177800f0", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1778019b", "parentcaller": "0x7fff177803bc", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00000201", "pretty_value": "KEY_QUERY_VALUE|0x00000200" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177802c2", "parentcaller": "0x7fff17780346", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "name" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177802c2", "parentcaller": "0x7fff17780346", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "name" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177803ea", "parentcaller": "0x7fff177819ed", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000084" }, { "name": "ValueName", "value": "000603xx" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "kernel32.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SortGetHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fba190" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SortCloseHandle" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0170" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000022c" }, { "name": "FileName", "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645200000" }, { "name": "SectionOffset", "value": "0x7121afe750" }, { "name": "ViewSize", "value": "0x00338000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 129 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en-AU" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff178432c9", "parentcaller": "0x7fff1778094e", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000022c" }, { "name": "ValueName", "value": "en" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff17780fba", "parentcaller": "0x7fff17755699", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000d4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177555e1", "parentcaller": "0x7fff177556aa", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 1, "id": 144 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff1773ba80", "parentcaller": "0x7fff1773ab16", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x910000f0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177cf562", "parentcaller": "0x7fff179875e5", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32.dll" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177cf562", "parentcaller": "0x7fff179875e5", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff179875e5", "parentcaller": "0x7fff179820c4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "InitializeCriticalSectionEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd4d00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:19:07,822", "thread_id": "8608", "caller": "0x7fff177cf3fe", "parentcaller": "0x7fff17982105", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0xc0100080", "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\pipe\\crashpad_4132_SQIGFBBJLBUYERTE" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff177cf425", "parentcaller": "0x7fff17982105", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000218" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\crashpad_4132_SQIGFBBJLBUYERTE" }, { "name": "FileInformationClass", "value": "23", "pretty_value": "FilePipeInformation" }, { "name": "FileInformation", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff177cf9bb", "parentcaller": "0x7fff177cff6d", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff17980ad2", "parentcaller": "0x7fff1798213f", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7fff17981e30" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff17980ae4", "parentcaller": "0x7fff1798213f", "category": "hooking", "api": "RtlAddVectoredExceptionHandler", "status": true, "return": "0x24640fa07e0", "arguments": [ { "name": "First", "value": "1" }, { "name": "Handler", "value": "0x7fff17981f50" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff17782947", "parentcaller": "0x7fff177828b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff17782947", "parentcaller": "0x7fff177828b9", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff17882986", "parentcaller": "0x7fff178828f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da762000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff178829aa", "parentcaller": "0x7fff178828f3", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da762000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff178829aa", "parentcaller": "0x7fff178828f3", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf" }, { "name": "BaseAddress", "value": "0x7fff17610000" }, { "name": "InitRoutine", "value": "0x7fff177ed2f0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff4753125f", "parentcaller": "0x7fff57c7e473", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff5780c976", "parentcaller": "0x7fff475481dc", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641036000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ce6a1", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-file-l1-2-1.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff577dac31", "parentcaller": "0x7fff47548089", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTempPathW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57814af0" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4770b000" }, { "name": "ModuleName", "value": "dbghelp.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00003000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:19:07,837", "thread_id": "8608", "caller": "0x7fff5780c976", "parentcaller": "0x7fff4754826c", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp" }, { "name": "BaseAddress", "value": "0x7fff47530000" }, { "name": "InitRoutine", "value": "0x7fff4754b1a0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:19:07,853", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x000000a0", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da5cfba0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:19:07,869", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da614280" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:19:07,884", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000021", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da5fa0e0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:19:07,900", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da614300" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": false, "return": "0x00000000", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da5b5840" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8608", "caller": "0x7fff59f69aff", "parentcaller": "0x7fff5a023d4d", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000080", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe" }, { "name": "BaseAddress", "value": "0x7ff7da540000" }, { "name": "InitRoutine", "value": "0x7ff7da5f5f80" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8608", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8608", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff7da614f90" }, { "name": "Parameter", "value": "0x7121977000" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8828", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000003c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 188 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8796", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8796", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8796", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:19:07,915", "thread_id": "8808", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641105000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "8808", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "8808", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "8828", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "8828", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "672", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "672", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:19:07,931", "thread_id": "672", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634096", "parentcaller": "0x7ff7da635b4a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000008", "pretty_value": "PAGE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da6349e7", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da6349e7", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da6349e7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "FlsGetValue2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da6349e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da6349e7", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a1500", "parentcaller": "0x7ff7da5f7156", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a1500", "parentcaller": "0x7ff7da5f7156", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a1519", "parentcaller": "0x7ff7da5f7156", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f805c", "parentcaller": "0x7ff7da5f8237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000000000" }, { "name": "RegionSize", "value": "0x800000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f805c", "parentcaller": "0x7ff7da5f8237", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x44ba56960000" }, { "name": "RegionSize", "value": "0x400000000" }, { "name": "Protection", "value": "0x00000001", "pretty_value": "PAGE_NOACCESS" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f80d8", "parentcaller": "0x7ff7da5a297f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x44ba56961000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000008000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634faa", "parentcaller": "0x7ff7da635b4a", "category": "misc", "api": "GetCommandLineA", "status": true, "return": "0x24641005890", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634fb7", "parentcaller": "0x7ff7da635b4a", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000018000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634607", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634607", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634607", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCMapStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bd3c0" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634607", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000028000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00002c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00004c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000070000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000080000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb00009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c2d71", "parentcaller": "0x7ff7da625bf2", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c2d81", "parentcaller": "0x7ff7da625bf2", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetSystemTimePreciseAsFileTime" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd5350" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000b4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634834", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634834", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57fb0000", "arguments": [ { "name": "lpLibFileName", "value": "kernel32" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634834", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "AreFileApisANSI" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57fd0f00" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634834", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634839", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634839", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634839", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "CompareStringEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c7130" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634839", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634862", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "EnumSystemLocalesEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57827f40" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634862", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da63488b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da63488b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da63488b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetDateFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578155b0" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da63488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da63488b", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da6348b4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetLocaleInfoEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577c0210" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da6348b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da6348b4", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da6348dd", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetTimeFormatEx" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5781d1a0" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da6348dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da6348dd", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634906", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "GetUserDefaultLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577dae80" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634906", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da63492f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsValidLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bad90" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da63492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da63492f", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634981", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634a67", "parentcaller": "0x7ff7da634981", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff577a0000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da634981", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LCIDToLocaleName" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff577bae60" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da634981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da634981", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b98", "parentcaller": "0x7ff7da6349aa", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "LocaleNameToLCID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57810070" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b17", "parentcaller": "0x7ff7da6349aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da634b48", "parentcaller": "0x7ff7da6349aa", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7ff7da7c4000" }, { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c6e14", "parentcaller": "0x7ff7da5c6b29", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c6e24", "parentcaller": "0x7ff7da5c6b29", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f8f850" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c6e44", "parentcaller": "0x7ff7da5c6b29", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000244" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c6e44", "parentcaller": "0x7ff7da5c6b29", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000244" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5c6e44", "parentcaller": "0x7ff7da5c6b29", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da6768ce", "parentcaller": "0x7ff7da55ad91", "category": "misc", "api": "GetCommandLineW", "status": true, "return": "0x24641003ed6", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4315", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4315", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4315", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "BaseAddress", "value": "0x7fff58070000" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4315", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58070000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-downlevel-shell32-l1-1-0.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4331", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff58070000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4348", "parentcaller": "0x7ff7da67692b", "category": "misc", "api": "CommandLineToArgvW", "status": true, "return": "0x246410254f0", "arguments": [ { "name": "CommandLine", "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" }, { "name": "NumArgs", "value": "13" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4398", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4398", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4398", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4398", "parentcaller": "0x7ff7da67692b", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f4398", "parentcaller": "0x7ff7da67692b", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b20", "parentcaller": "0x7ff7da5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000b8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b20", "parentcaller": "0x7ff7da5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000dc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ade6", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55adf6", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57febbf0" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24640ff0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 304 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429a0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae16", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae81", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 308 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae81", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55ae81", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55af7f", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 311 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55af7f", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da55af7f", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b20", "parentcaller": "0x7ff7da5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b20", "parentcaller": "0x7ff7da5a1bb6", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000e8000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5f5da1", "parentcaller": "0x7ff7da709e0b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cab91", "parentcaller": "0x7ff7da576aa9", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cab91", "parentcaller": "0x7ff7da576aa9", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cabaa", "parentcaller": "0x7ff7da576aa9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "ProcessPrng" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f05010" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cb5e6", "parentcaller": "0x7ff7da5f308f", "category": "filesystem", "api": "NtCreateFile", "status": false, "return": "0xffffffffc000003a", "pretty_return": "OBJECT_PATH_NOT_FOUND", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "no" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cb5e6", "parentcaller": "0x7ff7da5f308f", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0xa0100080", "pretty_value": "GENERIC_READ|GENERIC_EXECUTE|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cba1c", "parentcaller": "0x7ff7da5cbc6d", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000240" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cba51", "parentcaller": "0x7ff7da5cbc6d", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x40000003", "arguments": [ { "name": "SectionHandle", "value": "0x00000218" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24647000000" }, { "name": "SectionOffset", "value": "0x7121aff800" }, { "name": "ViewSize", "value": "0x136be000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cbe04", "parentcaller": "0x7ff7da5cc9a4", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:19:07,947", "thread_id": "8608", "caller": "0x7ff7da5cbe14", "parentcaller": "0x7ff7da5cc9a4", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "PrefetchVirtualMemory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57826590" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da5cbd36", "parentcaller": "0x7ff7da5f1e1d", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24647000000" }, { "name": "RegionSize", "value": "0x136be000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da5c698c", "parentcaller": "0x7ff7da574c5a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff7da540000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff7da5c6850" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da5a2b9b", "parentcaller": "0x7ff7da5a254f", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0xb0000f8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da574cc2", "parentcaller": "0x7ff7da5cbd52", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "71" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da574cc2", "parentcaller": "0x7ff7da5cbd52", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000218" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da574cc2", "parentcaller": "0x7ff7da576db8", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge" }, { "name": "DllBase", "value": "0x24647000000" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-fibers-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-l1-2-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "kernel32" }, { "name": "BaseAddress", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-string-l1-1-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-datetime-l1-1-1" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-core-localization-obsolete-l1-2-0" }, { "name": "BaseAddress", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:19:07,962", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "BaseAddress", "value": "0x24647000000" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b3c0", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x24647000000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b5f1", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000240" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7ff7da55b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "3980" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "identity_helper.exe" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b5f1", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000240", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7ff7da55b680" }, { "name": "Parameter", "value": "0x00000000" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "3980" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b620", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msedge.dll" }, { "name": "ModuleHandle", "value": "0x24647000000" }, { "name": "FunctionName", "value": "ChromeMain" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2464830a5c0" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600009c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7ff7da55b680" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000bc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000c8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7fff57c60000" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ucrtbase.dll" }, { "name": "ModuleHandle", "value": "0x7fff57c60000" }, { "name": "FunctionName", "value": "signal" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57cd18e0" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000d8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 359 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\uxtheme" }, { "name": "DllBase", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ADVAPI32.dll" }, { "name": "BaseAddress", "value": "0x7fff599c0000" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff599c0000", "arguments": [ { "name": "lpLibFileName", "value": "ADVAPI32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "EventRegister" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92e80" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "EventSetInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92af0" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000100000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\uxtheme.dll" }, { "name": "BaseAddress", "value": "0x7fff54fc0000" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff54fc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\uxtheme.dll" }, { "name": "dwFlags", "value": "0x00000008" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "uxtheme.dll" }, { "name": "ModuleHandle", "value": "0x7fff54fc0000" }, { "name": "FunctionName", "value": "ThemeInitApiHook" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff54fccde0" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xee/\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000260" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000260" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" }, { "name": "ValueName", "value": "AppsUseLightTheme" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSCTF.dll" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000264" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58380000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00114000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58490000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000258" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f600006c100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "1772" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000258", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f600006c100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1772" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641038000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000003c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845c000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000029000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 391 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845b000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600002d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000264" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "identity_helper.exe" }, { "name": "ModuleHandle", "value": "0x7ff7da540000" }, { "name": "FunctionName", "value": "GetHandleVerifier" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7ff7da5c6850" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5845b000" }, { "name": "ModuleName", "value": "MSCTF.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "35" }, { "name": "ProcessInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSCTF" }, { "name": "DllBase", "value": "0x7fff58380000" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600010c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000124000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000026c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff581a9000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff581a9000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000264" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000026c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff581a9000" }, { "name": "ModuleName", "value": "IMM32.DLL" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x7fff5780156c", "parentcaller": "0x246482cef2b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "SetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578139c0" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x246482ceecc", "parentcaller": "0x2464830a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "LoaderLockSampler" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x246482ceee8", "parentcaller": "0x2464830a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58378000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58378000" }, { "name": "ModuleName", "value": "GDI32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600002a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000278" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1772", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820eec1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 415 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000278" }, { "name": "ValueName", "value": "en-US" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000264" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465a6c0000" }, { "name": "SectionOffset", "value": "0x7121afe9d0" }, { "name": "ViewSize", "value": "0x00be3000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000027c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Windows\\Theme2282685266" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "\\Sessions\\1\\Windows\\Theme2610812591" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645800000" }, { "name": "SectionOffset", "value": "0x71222feb70" }, { "name": "ViewSize", "value": "0x000e2000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000290" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429c0000" }, { "name": "SectionOffset", "value": "0x71222feb70" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000288" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000027c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "3980", "caller": "0x7ff7da55b737", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000298" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000278" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000278" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000278" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00\\xb0\\x13\\x00\\x00\\x00\\x00\\x00\\xf7\\xa4\\x13\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000294" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246458f0000" }, { "name": "SectionOffset", "value": "0x7121afe780" }, { "name": "ViewSize", "value": "0x0013b000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000029c" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000029c" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00cY\\x1e\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645a30000" }, { "name": "SectionOffset", "value": "0x7121afe780" }, { "name": "ViewSize", "value": "0x001e6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600012c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000148000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600011c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000e4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000138000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600015c000" }, { "name": "RegionSize", "value": "0x0000a000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600014c000" }, { "name": "RegionSize", "value": "0x0000e000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000125000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a8" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002a4" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002a4" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00`\r\\x00\\x00\\x00\\x00\\x00 U\r\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002a8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645c20000" }, { "name": "SectionOffset", "value": "0x7121afe790" }, { "name": "ViewSize", "value": "0x000d6000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x000002ac" }, { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000002ac" }, { "name": "HandleName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak" }, { "name": "FileInformationClass", "value": "5", "pretty_value": "FileStandardInformation" }, { "name": "FileInformation", "value": "\\x00P\\x1d\\x02\\x00\\x00\\x00\\x00LA\\x1d\\x02\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000002b0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465b2b0000" }, { "name": "SectionOffset", "value": "0x7121afe890" }, { "name": "ViewSize", "value": "0x021d5000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000168000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegisterTraceGuidsW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92a10" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "OpenProcessToken" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6ac0" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b8" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "GetTokenInformation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d61d0" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\xc7\\x04\\x00`/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "IsValidSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6d80" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "GetLengthSid" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d68c0" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "ConvertSidToStringSidW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d5a70" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlGetDeviceFamilyInfoEnum" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f8f850" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000002b8" }, { "name": "ValueName", "value": "DeviceForm" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "USER32.dll" }, { "name": "BaseAddress", "value": "0x7fff581b0000" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff581b0000", "arguments": [ { "name": "lpLibFileName", "value": "USER32.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "PostThreadMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581d7ee0" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "windows", "api": "PostThreadMessageW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ProcessId", "value": "8972" }, { "name": "ThreadId", "value": "8608" }, { "name": "Message", "value": "0" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "USER32.dll" }, { "name": "ModuleHandle", "value": "0x7fff581b0000" }, { "name": "FunctionName", "value": "PeekMessageW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff581ba3e0" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQuerySection" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fed9f0" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000920" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "1", "pretty_value": "FILE_OPEN" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-wow64-l1-1-1.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578170e0" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegOpenKeyExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6180" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" }, { "name": "Handle", "value": "0x000002b8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegQueryValueExW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6160" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "ValueName", "value": "UBR" }, { "name": "Data", "value": "3803" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" }, { "name": "ValueName", "value": "DisplayVersion" }, { "name": "Data", "value": "22H2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "RegCloseKey" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff599d6930" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b8" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "IsWow64Process2" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578170e0" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000920" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429e0000" }, { "name": "SectionOffset", "value": "0x7121aff070" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000920" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000156c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000920" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000920" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000156c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645d00000" }, { "name": "SectionOffset", "value": "0x7121afef60" }, { "name": "ViewSize", "value": "0x00080000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000156c" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtDuplicateObject", "status": false, "return": "0xffffffffc0000022", "pretty_return": "ACCESS_DENIED", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x0000091c" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000000" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000091c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645d80000" }, { "name": "SectionOffset", "value": "0x7121afed60" }, { "name": "ViewSize", "value": "0x00040000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000059000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000ae000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600004d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60000af000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600005a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000049000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600017c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600017d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600005b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600004e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000091c" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000180000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002b8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f600006c310" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "1360" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002b8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f600006c310" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1360" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641039000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x97!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xa0!\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8608" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641106000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000140000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000190000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000191000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f600006c310" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000194000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000204000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000197000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x246482ceecc", "parentcaller": "0x2464830a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "PerfettoTrace" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x246482ceee8", "parentcaller": "0x2464830a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600005d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600019a000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000192000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600019d000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "1360", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f60001a0000" }, { "name": "RegionSize", "value": "0x00007000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "Kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "GetThreadDescription" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff578c8e60" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 01:19:07,978", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xe0\\x8f\\x00AF\\x02\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x008\\x00.\\x000\\x00.\\x003\\x009\\x006\\x007\\x00.\\x008\\x003\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00" }, { "name": "ThreadId", "value": "8608" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x8f\\x00AF\\x02\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x008\\x00.\\x000\\x00.\\x003\\x009\\x006\\x007\\x00.\\x008\\x003\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00" }, { "name": "ThreadId", "value": "8608" } ], "repeated": 1, "id": 574 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "kernel32.dll" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNEL32.DLL" }, { "name": "ModuleHandle", "value": "0x7fff57fb0000" }, { "name": "FunctionName", "value": "WerRegisterCustomMetadata" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57febbf0" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 589 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 1, "id": 594 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" }, { "name": "Milliseconds", "value": "4000" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600016c000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600012d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000197000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000165000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x705f70db3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400002000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400008000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400024000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400030000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000208000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000210000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640003c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400004000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400040000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400050000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400054000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002d4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050200" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "1304" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002d4", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050200" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "1304" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000212000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400058000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400068000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050200" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002dc" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640006c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640007c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640008c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 649 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff578c8ec6", "parentcaller": "0x246482b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00\\x9f\\x00AF\\x02\\x00\\x00@\\xf8\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x00\\x00\\x00\\x00\\x00\\x000\\xf5\\xaf!q\\x00\\x00\\x00p\\x9c\\x00AF\\x02\\x00\\x00\\x10\\xa0\\x00AF\\x02\\x00\\x00\\xc0\\x9b\\x00AF\\x02\\x00\\x00\\xf0\\xc3\\x0bZ\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xa1\\x00AF\\x02\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000nW\\xff\\x7f\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x1drW\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1304" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 654 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x246482ceecc", "parentcaller": "0x246484f1293", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "HangWatcher" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x246482ceee8", "parentcaller": "0x246484f1293", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "1304", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400090000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000ac000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00\\x9f\\x00AF\\x02\\x00\\x00@\\xf8\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82\\x00\\x00\\x00\\x00\\x00\\x000\\xf5\\xaf!q\\x00\\x00\\x00p\\x9c\\x00AF\\x02\\x00\\x00\\x10\\xa0\\x00AF\\x02\\x00\\x00\\xc0\\x9b\\x00AF\\x02\\x00\\x00\\xf0\\xc3\\x0bZ\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xa1\\x00AF\\x02\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000nW\\xff\\x7f\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x1drW\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8608" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640009c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "winrt_app_id.CrUtilityMain" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "shell32.dll" }, { "name": "BaseAddress", "value": "0x7fff58be0000" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff58be0000", "arguments": [ { "name": "lpLibFileName", "value": "shell32.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002f8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050160" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6020" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x000002f8", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050160" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6020" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000213000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050160" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000308" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600021c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f600020c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400025000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640008d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f530fd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24640e21000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641048000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff578c8ec6", "parentcaller": "0x246482b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x80\\x04AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6020" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x246482ceecc", "parentcaller": "0x2464830a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolServiceThread" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x246482ceee8", "parentcaller": "0x2464830a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6020", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820eec1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000304" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050140" }, { "name": "CreateFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6016" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400005000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641049000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000215000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400069000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050140" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000031c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640006d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640007d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff578c8ec6", "parentcaller": "0x246482b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x85\\x04AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6016" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640009e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x246482ceecc", "parentcaller": "0x246482ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolForegroundWorker" } ], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x246482ceee8", "parentcaller": "0x246482ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577c30ce", "parentcaller": "0x24648254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6016", "caller": "0x7fff577c30ce", "parentcaller": "0x24648254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" }, { "name": "Milliseconds", "value": "60608" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000318" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050100" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "9072" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000318", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050100" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "9072" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464103f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400059000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000216000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f6400050100" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff5780c6f3", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00p#\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9072" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff5780c728", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "24" }, { "name": "ThreadInformation", "value": "\\x05\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9072" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff5780c752", "parentcaller": "0x7fff5780c5aa", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "22" }, { "name": "ThreadInformation", "value": "\\x02\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9072" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff5780ebae", "parentcaller": "0x24647c4c4eb", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00p#\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\xff\\xff\\xff" }, { "name": "ThreadId", "value": "9072" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000032c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640008e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff578c8ec6", "parentcaller": "0x246482b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40c\\x04AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9072" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x246482ceecc", "parentcaller": "0x246482ced3f", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "ThreadPoolBackgroundWorker" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x246482ceee8", "parentcaller": "0x246482ced3f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff577c30ce", "parentcaller": "0x24648254b81", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "9072", "caller": "0x7fff577c30ce", "parentcaller": "0x24648254b81", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" }, { "name": "Milliseconds", "value": "60607" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000328" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f64000500c0" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "6780" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "msedge.dll" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000328", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f64000500c0" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "6780" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641040000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641107000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000c4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000007000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000218000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400014000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x246482c9bd0" }, { "name": "Parameter", "value": "0x2f64000500c0" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57806f4c", "parentcaller": "0x246482c9c51", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000033c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400026000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff578c8ec6", "parentcaller": "0x246482b0158", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "38" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x81\\x04AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6780" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400009000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400015000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640009f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x246482ceecc", "parentcaller": "0x2464830a10d", "category": "threading", "api": "SetThreadDescription", "status": true, "return": "0x10000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadDescription", "value": "Chrome_ChildIOThread" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x246482ceee8", "parentcaller": "0x2464830a10d", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400006000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000e8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000b1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000c1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000c2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000ad000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000c3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57820e99", "parentcaller": "0x24648ad9c7a", "category": "filesystem", "api": "NtSetInformationFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "FileInformationClass", "value": "30", "pretty_value": "FileCompletionInformation" }, { "name": "FileInformation", "value": "@\\x03\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\r\\x00d/\\x00\\x00" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640006e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400051000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000e1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d53aa", "parentcaller": "0x24648ad9b5f", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00P\\x00\\x00\\x00nwh\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "80" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400007000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640000a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400104000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x24648ad9d2e", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\xc1Y`\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\xf1\\xa2\n=\\xa5h\\xbd\\xa0\\x9dkQp\\xf8\\xf4_\\xef\\xac\\x8f\\xdd\\xacUA\\xc6~k\\xae\\x8b\\xc30\\x87\\xc2\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15Z(\\xb5#\\xc8\\x9f{\\xab$Hs\\xe2!\\xce\\x90\\x10\\x00\\x00\\x00\\x88\\x01\\x00\\x00%zh\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "4096" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640000b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f64000d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400106000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57806f4c", "parentcaller": "0x24647444292", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000004" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000344" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d6785", "parentcaller": "0x246474442a3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000004" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246429e0000" }, { "name": "SectionOffset", "value": "0x71229fe540" }, { "name": "ViewSize", "value": "0x00020000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000004" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400114000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "8000" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d53aa", "parentcaller": "0x24647ca0093", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xca|h\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400055000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400016000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400120000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640007e000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640012c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "48" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d53aa", "parentcaller": "0x246480cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x91}h\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "88" } ], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400108000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640010c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff57801762", "parentcaller": "0x246472bd9a5", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400110000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 01:19:07,994", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\x06AF\\x02\\x00\\x00(N\\x03AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xffa08\\x06AF\\x02\\x00\\x00 \\xffe7\\xffaf\"q\\x00\\x00\\x00\\xffe4I\\xffb9\\x17\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xffa08\\x06AF\\x02\\x00\\x00\\xfff8\\xff81\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00F\\x02\\x00\\x00h\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x10\\xffe7\\xffaf\"q\\x00\\x00\\x00\\xff98\\xff85\\xffdb\\x17\\xffff\\x7f\\x00\\x00 \\xffe7\\xffaf\"q\\x00\\x00\\x000H\\x08AF\\x02\\x00\\x00\\xffb0tOX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00 \\xffe9\\xffaf\"q\\x00\\x00\\x00\\xffa08\\x06AF\\x02\\x00\\x00\\xff90;\\x06AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x0e\\x00\\x00\\x00\\x00\\x00LH\\x08AF\\x02\\x00\\x000\\x00\\x00\\x00F\\x02\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffe7\\xffaf\"q\\x00\\x00\\x00@\\x00\\x00\\x00F\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff908\\x06AF\\x02\\x00\\x00\\x19hOX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1626 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath" } ], "repeated": 0, "id": 1627 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "CommandLine" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine" } ], "repeated": 0, "id": 1628 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType" } ], "repeated": 0, "id": 1629 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7fff00000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1630 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1631 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" } ], "repeated": 0, "id": 1632 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions" } ], "repeated": 0, "id": 1633 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses" } ], "repeated": 0, "id": 1634 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType" } ], "repeated": 0, "id": 1635 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId" } ], "repeated": 0, "id": 1636 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1637 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity" } ], "repeated": 0, "id": 1638 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1639 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb1\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xe0\\xb2\\xef\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1640 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName" } ], "repeated": 0, "id": 1641 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1642 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000047c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes" } ], "repeated": 0, "id": 1643 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 1644 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000446" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1645 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1646 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1647 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1648 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1649 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000446" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1650 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1651 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1652 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1653 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1654 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}" } ], "repeated": 0, "id": 1655 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1656 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1657 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1658 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1659 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1660 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb0\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xb1\\xef\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1661 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff5854fae4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1662 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 1663 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1664 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1665 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1666 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1667 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xc2\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xe0\\xc3\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1668 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb0\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xb1\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1669 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1670 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1671 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1672 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1673 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1674 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1675 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1676 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1677 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1678 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1679 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000446" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1680 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1681 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 1682 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 1683 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1684 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1685 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1686 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1687 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1688 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1689 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1690 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 1691 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1692 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xc1\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xc2\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1693 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1694 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1695 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1696 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000446" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 1697 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1698 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1699 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1700 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1701 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1702 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1703 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1704 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1705 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xbf\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xa0\\xc0\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1706 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1707 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1708 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1709 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1710 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1711 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1712 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1713 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1714 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)" } ], "repeated": 0, "id": 1715 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1716 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xad\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x000\\xae\\xef\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1717 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 1718 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1719 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32" } ], "repeated": 0, "id": 1720 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000446" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 1721 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1722 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1723 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 1724 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xac\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00F\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xad\\xef\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1725 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000446" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1726 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000446" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 1727 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 1728 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1729 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1730 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1731 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xbe\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x000\\xbf\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1732 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1733 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32" } ], "repeated": 0, "id": 1734 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1735 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 1736 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler" } ], "repeated": 0, "id": 1737 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1738 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1739 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xbd\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xd0\\xbe\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1740 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32" } ], "repeated": 0, "id": 1741 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1742 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000446" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 1743 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID" } ], "repeated": 0, "id": 1744 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000446" } ], "repeated": 0, "id": 1745 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1746 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xbd\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xbe\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1747 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1748 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1749 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1750 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000472" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1751 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000472" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer" } ], "repeated": 0, "id": 1752 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1753 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation" } ], "repeated": 0, "id": 1754 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1755 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1756 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}" } ], "repeated": 0, "id": 1757 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000472" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs" } ], "repeated": 0, "id": 1758 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1759 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1760 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1761 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff50870000" } ], "repeated": 0, "id": 1762 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff50870000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1763 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff50886540" } ], "repeated": 0, "id": 1764 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1765 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "820", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff508865f0" } ], "repeated": 0, "id": 1766 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS" }, { "name": "DllBase", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 1767 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll" }, { "name": "BaseAddress", "value": "0x7fff4cbf0000" } ], "repeated": 0, "id": 1768 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff4cbf0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 1769 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7fff4cbf0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff4cbf7340" } ], "repeated": 0, "id": 1770 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7fff4cbf0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 1771 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.StateRepositoryPS.dll" }, { "name": "ModuleHandle", "value": "0x7fff4cbf0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff4cbf7380" } ], "repeated": 0, "id": 1772 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1773 }, { "timestamp": "2026-05-29 01:19:08,056", "thread_id": "3272", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1774 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410a4000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1775 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1776 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" }, { "name": "Handle", "value": "0x0000045e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}" } ], "repeated": 0, "id": 1777 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000045e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000044a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1778 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1779 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000044a" } ], "repeated": 0, "id": 1780 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045e" } ], "repeated": 0, "id": 1781 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1782 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1783 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" } ], "repeated": 0, "id": 1784 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.Package" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package" } ], "repeated": 0, "id": 1785 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff98\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffeb\\xffaf\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x006\nAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x02\\xff89\\xffb2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10=\\x06AF\\x02\\x00\\x00\\xfff8\\xff98\\x08AF\\x02\\x00\\x00\\xffd0\\xff98\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x006\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff98\\x08AF\\x02\\x00\\x00\\x006\nAF\\x02\\x00\\x00\\x10=\\x06AF\\x02\\x00\\x00@\\xfffb\\x05AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10=\\x06AF\\x02\\x00\\x00P7\nAF\\x02\\x00\\x00P7\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P7\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x006\nAF\\x02\\x00\\x00@\\xfffb\\x05AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffec\\xffaf\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0:\nAF\\x02\\x00\\x00\\xffd0\\xff98\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 1786 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType" } ], "repeated": 0, "id": 1787 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Server" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server" } ], "repeated": 0, "id": 1788 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410a5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1789 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1790 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath" } ], "repeated": 0, "id": 1791 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading" } ], "repeated": 0, "id": 1792 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel" } ], "repeated": 0, "id": 1793 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000045c" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes" } ], "repeated": 0, "id": 1794 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410a7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1795 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer" } ], "repeated": 0, "id": 1796 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser" } ], "repeated": 0, "id": 1797 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker" } ], "repeated": 0, "id": 1798 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 1799 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions" } ], "repeated": 0, "id": 1800 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags" } ], "repeated": 0, "id": 1801 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 1802 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464108a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1803 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641095000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1804 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1805 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}" } ], "repeated": 0, "id": 1806 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1807 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1808 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048e" } ], "repeated": 0, "id": 1809 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1810 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1811 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1812 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1813 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1814 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1815 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1816 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" }, { "name": "Handle", "value": "0x00000492" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}" } ], "repeated": 0, "id": 1817 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000492" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000496" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1818 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1819 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000496" } ], "repeated": 0, "id": 1820 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000492" } ], "repeated": 0, "id": 1821 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1822 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1823 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" } ], "repeated": 0, "id": 1824 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1825 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410a8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1826 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000472" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1827 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1828 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000472" } ], "repeated": 0, "id": 1829 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1830 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1831 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1832 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000490" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1833 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59fafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000494" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000490" }, { "name": "FileName", "value": "C:\\Windows\\System32\\capauthz.dll" } ], "repeated": 0, "id": 1834 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000494" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501a0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00051000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1835 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501ea000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1836 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1837 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1838 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff501d8000" }, { "name": "ModuleName", "value": "capauthz.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1839 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1840 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410aa000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1841 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "WINTRUST.dll" } ], "repeated": 0, "id": 1842 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000498" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aa0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00067000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1843 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1844 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1845 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1846 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1847 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1848 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 1849 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1850 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1851 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57aea000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1852 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1853 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000047c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1854 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1855 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1856 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WINTRUST" }, { "name": "DllBase", "value": "0x7fff57aa0000" } ], "repeated": 0, "id": 1857 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "h\\x89\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1858 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xca\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x10\\xc7\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1859 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1860 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8F\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1861 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1862 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xc6\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1863 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xde\\xa9|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x000\\xcf\\xef\"q\\x00\\x00\\x00(\\xcf\\xef\"q\\x00\\x00\\x00\\xf8\\xce\\xef\"q\\x00\\x00\\x00\\x18\\xcf\\xef\"" } ], "repeated": 0, "id": 1864 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc6\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd\\xef\"q\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1865 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1866 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xc5\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00\\xed\\xc3@\\x9d\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00m\\x00a\\x00\\xf0\\xc5\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1867 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1868 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8K\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1869 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xc3\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1870 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00~\\xac|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x90\\xcb\\xef\"q\\x00\\x00\\x00\\x88\\xcb\\xef\"q\\x00\\x00\\x00X\\xcb\\xef\"q\\x00\\x00\\x00x\\xcb\\xef\"" } ], "repeated": 0, "id": 1871 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc3\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc9\\xef\"q\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1872 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047c" } ], "repeated": 0, "id": 1873 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 2, "id": 1874 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "WindowsDeleteString" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584e7690" } ], "repeated": 0, "id": 1875 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 4, "id": 1876 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}" } ], "repeated": 0, "id": 1877 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1878 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1879 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000482" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 1880 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000482" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 1881 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xd1\\xef\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x82\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00`\\xd2\\xef\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 1882 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1883 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1884 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1885 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1886 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1887 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1888 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1889 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1890 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000480" } ], "repeated": 0, "id": 1891 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1892 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\x80\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1893 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xc3\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00+\\x9e\\x9d\\x1d\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1894 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1895 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8I\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1896 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1897 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xc8\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1898 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xc8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xd6\\xef\"q\\x00\\x00\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1899 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1900 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x83\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1901 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xca\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00\\x91)\\x8a\\xd5\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1902 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1903 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xe8F\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1904 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1905 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xc4\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1906 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd3\\xef\"q\\x00\\x00\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1907 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1908 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 1, "id": 1909 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1910 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}" } ], "repeated": 0, "id": 1911 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000482" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1912 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1913 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1914 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1915 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1916 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1917 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1918 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1919 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1920 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1921 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\x84\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1922 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1923 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(I\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1924 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1925 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xc7\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1926 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xde\\xa9|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x000\\xcf\\xef\"q\\x00\\x00\\x00(\\xcf\\xef\"q\\x00\\x00\\x00\\xf8\\xce\\xef\"q\\x00\\x00\\x00\\x18\\xcf\\xef\"" } ], "repeated": 0, "id": 1927 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc7\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd\\xef\"q\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1928 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x83\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1929 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xc9\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00\\x84\\x07\\xf0\\xa7\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1930 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8H\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1931 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1932 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xca\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1933 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00~\\xac|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x90\\xcb\\xef\"q\\x00\\x00\\x00\\x88\\xcb\\xef\"q\\x00\\x00\\x00X\\xcb\\xef\"q\\x00\\x00\\x00x\\xcb\\xef\"" } ], "repeated": 0, "id": 1934 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xca\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc9\\xef\"q\\x00\\x00\\x00\\x88\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1935 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 1936 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1937 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1938 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1939 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" }, { "name": "Handle", "value": "0x0000048a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}" } ], "repeated": 0, "id": 1940 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000048a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000482" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32" } ], "repeated": 0, "id": 1941 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1942 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000482" } ], "repeated": 0, "id": 1943 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 1944 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1945 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1946 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1947 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 1948 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\capauthz" }, { "name": "DllBase", "value": "0x7fff501a0000" } ], "repeated": 0, "id": 1949 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000480" } ], "repeated": 0, "id": 1950 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1951 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\x80\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1952 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80-\\x06AF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1953 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1954 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HG\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1955 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1956 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8.\\x06AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1957 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x1e\\xbf|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf0\\xd8\\xef\"q\\x00\\x00\\x00\\xe8\\xd8\\xef\"q\\x00\\x00\\x00\\xb8\\xd8\\xef\"q\\x00\\x00\\x00\\xd8\\xd8\\xef\"" } ], "repeated": 0, "id": 1958 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0.\\x06AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xd6\\xef\"q\\x00\\x00\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1959 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1960 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x607\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00c\\x00a\\x00p\\x00a\\x00u\\x00t\\x00h\\x00z\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 1961 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`/\\x06AF\\x02\\x00\\x00`\\x00\\x00\\x00F\\x02\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00F\\x02\\x00\\x00\\xa0\\\\x01AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00`O\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00pE\\x00AF\\x02\\x00\\x00\\x80U\\x00A" } ], "repeated": 0, "id": 1962 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1963 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "xG\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 1964 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1965 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xc8\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1966 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xbe\\xa3|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xd5\\xef\"q\\x00\\x00\\x00H\\xd5\\xef\"q\\x00\\x00\\x00\\x18\\xd5\\xef\"q\\x00\\x00\\x008\\xd5\\xef\"" } ], "repeated": 0, "id": 1967 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xc8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd3\\xef\"q\\x00\\x00\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1968 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1969 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 2, "id": 1970 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff58568bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8972" } ], "repeated": 0, "id": 1971 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1972 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1973 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x909\tAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000:\tAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P:\tAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00d;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00x;\tAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0;\tAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8;\tAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80:\tAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06;\tAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0c;\tAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 1974 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1975 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 1976 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1977 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x909\tAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000:\tAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P:\tAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00d;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00x;\tAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0;\tAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8;\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8;\tAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80:\tAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06;\tAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0c;\tAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 1978 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 1979 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 1980 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641116000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1981 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5781cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000490" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1982 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577ced78", "parentcaller": "0x7fff5781cf77", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000498" }, { "name": "MutexName", "value": "" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 1983 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1984 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1985 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1986 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1987 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1988 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1989 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 1990 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "MSASN1.dll" } ], "repeated": 0, "id": 1991 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641096000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1992 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll" } ], "repeated": 0, "id": 1993 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 1994 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 1995 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 1996 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59faf7b0", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000480" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 1997 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 1998 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" } ], "repeated": 0, "id": 1999 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 2000 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2001 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2002 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59faf7b0", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000480" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msasn1.dll" } ], "repeated": 0, "id": 2003 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57130000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2004 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2005 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2006 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2007 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2008 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2009 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 2010 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59faf7b0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000480" } ], "repeated": 0, "id": 2011 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5713a000" }, { "name": "ModuleName", "value": "MSASN1.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2012 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\MSASN1" }, { "name": "DllBase", "value": "0x7fff57130000" } ], "repeated": 0, "id": 2013 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}" }, { "name": "Handle", "value": "0x0000047e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}" } ], "repeated": 0, "id": 2014 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000047e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004a6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2015 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2016 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" } ], "repeated": 0, "id": 2017 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000047e" } ], "repeated": 0, "id": 2018 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2019 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2020 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msasn1" }, { "name": "BaseAddress", "value": "0x7fff57130000" }, { "name": "InitRoutine", "value": "0x7fff57135860" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2021 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2022 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57b03000" }, { "name": "ModuleName", "value": "WINTRUST.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2023 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff571357f9", "parentcaller": "0x7fff571356a6", "category": "registry", "api": "RegOpenKeyExA", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1" } ], "repeated": 0, "id": 2024 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff571357f9", "parentcaller": "0x7fff571356a6", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wintrust" }, { "name": "BaseAddress", "value": "0x7fff57aa0000" }, { "name": "InitRoutine", "value": "0x7fff57ab1670" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2025 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\capauthz" }, { "name": "BaseAddress", "value": "0x7fff501a0000" }, { "name": "InitRoutine", "value": "0x7fff501d2fd0" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 2026 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff46d8f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2027 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff46d8f000" }, { "name": "ModuleName", "value": "execmodelclient.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2028 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a68cd", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz" }, { "name": "Handle", "value": "0x0000045c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz" } ], "repeated": 0, "id": 2029 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a6915", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegCreateKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x0000000e", "pretty_value": "KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS" }, { "name": "Handle", "value": "0x00000448" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2030 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a695a", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegCreateKeyExW", "status": false, "return": "0x000003fd", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" }, { "name": "Class", "value": "" }, { "name": "Access", "value": "0x00000002", "pretty_value": "KEY_SET_VALUE" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" }, { "name": "Disposition", "value": "2", "pretty_value": "REG_OPENED_EXISTING_KEY" } ], "repeated": 0, "id": 2031 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a6b50", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" } ], "repeated": 0, "id": 2032 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a6b7a", "parentcaller": "0x7fff501a4292", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2033 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501a6ec9", "parentcaller": "0x7fff501ab441", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect" } ], "repeated": 0, "id": 2034 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501ab576", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x00000448" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 2035 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2036 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2037 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2038 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "Data", "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2039 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "CapSids" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2040 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "CapSids" }, { "name": "Data", "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2041 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2042 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2043 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501abca8", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 2044 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff501abcde", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2045 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff5781026b", "parentcaller": "0x7fff46d39bfa", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000448" } ], "repeated": 0, "id": 2046 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff46d39c3b", "parentcaller": "0x7fff46d5d3e7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xf6\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf7\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2047 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff46d39cb3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2048 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" }, { "name": "Handle", "value": "0x000004aa" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}" } ], "repeated": 0, "id": 2049 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641117000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2050 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004aa" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004ae" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2051 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "Handle", "value": "0x00000110" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps" } ], "repeated": 0, "id": 2052 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ae" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2053 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType" } ], "repeated": 0, "id": 2054 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ae" } ], "repeated": 0, "id": 2055 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004aa" } ], "repeated": 0, "id": 2056 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2057 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2058 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior" } ], "repeated": 0, "id": 2059 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2060 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2061 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2062 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2063 }, { "timestamp": "2026-05-29 01:19:08,072", "thread_id": "3272", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_UserInControlOfTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2064 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2065 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2066 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2067 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7836", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2068 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2069 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2070 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7a6c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "ADMXMetadataBoth" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth" } ], "repeated": 0, "id": 2071 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value" } ], "repeated": 0, "id": 2072 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7ca8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000110" }, { "name": "ValueName", "value": "Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value" } ], "repeated": 0, "id": 2073 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 2074 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2075 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2076 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2077 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2078 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000448" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps" } ], "repeated": 0, "id": 2079 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType" } ], "repeated": 0, "id": 2080 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior" } ], "repeated": 0, "id": 2081 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2082 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2083 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2084 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2085 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000048a" } ], "repeated": 0, "id": 2086 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceAllowTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2087 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2088 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2089 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2090 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2091 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000488" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2092 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff522ddb1b", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "30Value" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value" } ], "repeated": 0, "id": 2093 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2094 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d76a9", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" } ], "repeated": 0, "id": 2095 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x08\\x8a\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00`O\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00\\x80U\\x00AF\\x02\\x00\\x00`O\\x00A" } ], "repeated": 0, "id": 2096 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2097 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2098 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2099 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2100 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xc7\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2101 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps" } ], "repeated": 0, "id": 2102 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc7\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd\\xef\"q\\x00\\x00\\x00p\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2103 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xa8\\x80\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2104 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d723c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType" } ], "repeated": 0, "id": 2105 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xc5\\x08AF\\x02\\x00\\x00`\\x00\\x00\\x00s\\x00R\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00_\\x00F\\x00o\\x00r\\x00c\\x00e\\x00A\\x00l\\x00l\\x00o\\x00w\\x00T\\x00h\\x00e\\x00s\\x00e\\x00A\\x00p\\x00p\\x00s\\x00" } ], "repeated": 0, "id": 2106 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2107 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d72a8", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "Behavior" }, { "name": "Data", "value": "139296" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior" } ], "repeated": 0, "id": 2108 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8J\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2109 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2110 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm" } ], "repeated": 0, "id": 2111 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8\\xcb\\x08AF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2112 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2113 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2114 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2115 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2116 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground_ForceDenyTheseApps" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname" } ], "repeated": 0, "id": 2117 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2118 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath" } ], "repeated": 0, "id": 2119 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2120 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz" } ], "repeated": 0, "id": 2121 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7836", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2122 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d78f6", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ADMXMetadataUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser" } ], "repeated": 0, "id": 2123 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d79b1", "parentcaller": "0x7fff522d5a59", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "ADMXMetadataDevice" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice" } ], "repeated": 0, "id": 2124 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x1f\\xc9i\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2125 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5c61", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2126 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d5d7c", "parentcaller": "0x7fff522d5ac0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2127 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "shcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff58070000" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" } ], "repeated": 0, "id": 2128 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d71e2", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" }, { "name": "Handle", "value": "0x000004a8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground" } ], "repeated": 0, "id": 2129 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff4100b596", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2130 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "PolicyType" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType" } ], "repeated": 0, "id": 2131 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.LimitedAccessFeatures" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures" } ], "repeated": 0, "id": 2132 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff4100b5f6", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000470" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000488" } ], "repeated": 0, "id": 2133 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4100b625", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2134 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000045c" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00L\\x00i\\x00m\\x00i\\x00t\\x00e\\x00d\\x00A\\x00c\\x00c\\x00e\\x00s\\x00s\\x00F\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff97\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc7\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00b\\xffa5\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90R\nAF\\x02\\x00\\x00\\xfff8\\xff97\\x08AF\\x02\\x00\\x00\\xffd0\\xff97\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff97\\x08AF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\xff90R\nAF\\x02\\x00\\x00\\xffb0\\xff89\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90R\nAF\\x02\\x00\\x00\\xffa01\nAF\\x02\\x00\\x00\\xffa01\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa01\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\xffb0\\xff89\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc8\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`:\nAF\\x02\\x00\\x00\\xffd0\\xff97\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2135 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4100b635", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000488" } ], "repeated": 0, "id": 2136 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4100b644", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000470" } ], "repeated": 0, "id": 2137 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d732c", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "MergeAlgorithm" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm" } ], "repeated": 0, "id": 2138 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d739f", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirectMapped" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped" } ], "repeated": 0, "id": 2139 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7402", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "RegKeyPathRedirect" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect" } ], "repeated": 0, "id": 2140 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d755e", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2141 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath" } ], "repeated": 0, "id": 2142 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d75df", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyname" }, { "name": "Data", "value": "LetAppsRunInBackground" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname" } ], "repeated": 0, "id": 2143 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7647", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2144 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d776a", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicypath" }, { "name": "Data", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath" } ], "repeated": 0, "id": 2145 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xbc#\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9148" } ], "repeated": 0, "id": 2146 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2147 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d77f6", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicyismultisz" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz" } ], "repeated": 0, "id": 2148 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d7836", "parentcaller": "0x7fff522d6abb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a8" }, { "name": "ValueName", "value": "grouppolicymultiszSeparatorChar" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar" } ], "repeated": 0, "id": 2149 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer" } ], "repeated": 0, "id": 2150 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser" } ], "repeated": 0, "id": 2151 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d6e85", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } ], "repeated": 0, "id": 2152 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff522d6d68", "parentcaller": "0x7fff522d6097", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy" } ], "repeated": 0, "id": 2153 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2154 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2155 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2156 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000045c" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions" } ], "repeated": 0, "id": 2157 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641097000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2158 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff501ab576", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" }, { "name": "Handle", "value": "0x000004ac" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe" } ], "repeated": 0, "id": 2159 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2160 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "AppPackageType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType" } ], "repeated": 0, "id": 2161 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2162 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "PackageSid" }, { "name": "Data", "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid" } ], "repeated": 0, "id": 2163 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "CapSids" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2164 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8fc0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "CapSids" }, { "name": "Data", "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids" } ], "repeated": 0, "id": 2165 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff501a8f48", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2166 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "ValueName", "value": "ApplicationFlags" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags" } ], "repeated": 0, "id": 2167 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff501abca8", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x80000002" } ], "repeated": 0, "id": 2168 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff501abcde", "parentcaller": "0x7fff501a42f2", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ac" } ], "repeated": 0, "id": 2169 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b26e8", "parentcaller": "0x7fff577b132e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xf3\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\xe6\tj\\x01\\x00\\x00\\x00r\\xf3n<:\\xf5O\\xa5\\x7fR\\x0eQ" } ], "repeated": 0, "id": 2170 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ddf8a", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "ntdll.dll" }, { "name": "BaseAddress", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2171 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff577ddf8a", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff59f50000", "arguments": [ { "name": "lpLibFileName", "value": "ntdll.dll" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 2172 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577dac31", "parentcaller": "0x7fff577ddfa1", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlIsStateSeparationEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc8560" } ], "repeated": 0, "id": 2173 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2174 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff578546a3", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE" } ], "repeated": 0, "id": 2175 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3b20", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 2176 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2177 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2178 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2179 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2180 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577dd70a", "parentcaller": "0x7fff577b8db6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2181 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410af000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2182 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 2183 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2184 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000448" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 2185 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2186 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577ddb13", "parentcaller": "0x7fff577dda55", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 2187 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577dd70a", "parentcaller": "0x7fff577b8db6", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2188 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "BaseAddress", "value": "0x7fff457f0000" } ], "repeated": 0, "id": 2189 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff457f0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2190 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7fff457f0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff457ffa40" } ], "repeated": 0, "id": 2191 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7fff457f0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff457fe870" } ], "repeated": 0, "id": 2192 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "ModuleHandle", "value": "0x7fff457f0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff457ff430" } ], "repeated": 0, "id": 2193 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b3d26", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "DesiredAccess", "value": "0x00000004", "pretty_value": "SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000448" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" } ], "repeated": 0, "id": 2194 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b3d37", "parentcaller": "0x7fff577b3354", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000448" } ], "repeated": 0, "id": 2195 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000004b4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645e60000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2196 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645e60000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 2197 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff577b341d", "parentcaller": "0x7fff577b3f0a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b4" } ], "repeated": 0, "id": 2198 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2199 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2200 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 2201 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "3272", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2202 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2203 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2204 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US" } ], "repeated": 0, "id": 2205 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000045c" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 2206 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "DesiredAccess", "value": "0x000f0005", "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000045c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KernelBase.dll.mui" } ], "repeated": 0, "id": 2207 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000438" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645e60000" }, { "name": "SectionOffset", "value": "0x7121afab90" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2208 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000438" } ], "repeated": 0, "id": 2209 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2210 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2211 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2212 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\bcryptprimitives.dll" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 2213 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff57ef0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\system32\\bcryptprimitives.dll" }, { "name": "dwFlags", "value": "0x00000000" } ], "repeated": 0, "id": 2214 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f04460" } ], "repeated": 0, "id": 2215 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2216 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2217 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "31" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xbb\\xaf!q\\x00\\x00\\x00h\\xbb\\xaf!q\\x00\\x00\\x00\\xd0\\x92\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00q\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00GF\\x02\\x00\\x00\\x98@\tAF\\x02\\x00\\x00\\x90\\xc1\\xaf!" } ], "repeated": 0, "id": 2218 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2219 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 2220 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410b0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2221 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 2222 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 2223 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 2224 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 2225 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 2226 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 2227 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2228 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2229 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2230 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2231 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2232 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 2233 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004bc" } ], "repeated": 0, "id": 2234 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 2235 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004b8" } ], "repeated": 0, "id": 2236 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" }, { "name": "Handle", "value": "0x000004c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures" } ], "repeated": 0, "id": 2237 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004c0" }, { "name": "SubKey", "value": "com.microsoft.windows.taskbar.requestPinSecondaryTile" }, { "name": "Handle", "value": "0x000004c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile" } ], "repeated": 0, "id": 2238 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 2239 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2240 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "04c19204-10d9-450a-95c4-2910c8f72be3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)" } ], "repeated": 0, "id": 2241 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2242 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2243 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2244 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff458cf000" }, { "name": "ModuleName", "value": "Windows.ApplicationModel.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2245 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.CryptographicBuffer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer" } ], "repeated": 0, "id": 2246 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c0" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00B\\x00u\\x00f\\x00f\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff92\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc2\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00PP\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\"\\xffde\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P?\\x06AF\\x02\\x00\\x00\\xfff8\\xff92\\x08AF\\x02\\x00\\x00\\xffd0\\xff92\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00PP\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff92\\x08AF\\x02\\x00\\x00PP\\x08AF\\x02\\x00\\x00P?\\x06AF\\x02\\x00\\x00\\xfff0\\xff85\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P?\\x06AF\\x02\\x00\\x00@\\xffcb\\x05AF\\x02\\x00\\x00@\\xffcb\\x05AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PP\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffcb\\x05AF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00PP\\x08AF\\x02\\x00\\x00\\xfff0\\xff85\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc3\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffca\\x05AF\\x02\\x00\\x00\\xffd0\\xff92\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2247 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType" } ], "repeated": 0, "id": 2248 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server" } ], "repeated": 0, "id": 2249 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath" } ], "repeated": 0, "id": 2250 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading" } ], "repeated": 0, "id": 2251 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel" } ], "repeated": 0, "id": 2252 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004c0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes" } ], "repeated": 0, "id": 2253 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer" } ], "repeated": 0, "id": 2254 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser" } ], "repeated": 0, "id": 2255 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2256 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2257 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions" } ], "repeated": 0, "id": 2258 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2259 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c0" } ], "repeated": 0, "id": 2260 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CryptoWinRT" }, { "name": "DllBase", "value": "0x2465d490000" } ], "repeated": 0, "id": 2261 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "BaseAddress", "value": "0x2465d490000" } ], "repeated": 0, "id": 2262 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x2465d490000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2263 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2465d490000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2465d49f560" } ], "repeated": 0, "id": 2264 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2465d490000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2465d498590" } ], "repeated": 0, "id": 2265 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "CryptoWinRT.dll" }, { "name": "ModuleHandle", "value": "0x2465d490000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x2465d495cd0" } ], "repeated": 0, "id": 2266 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" }, { "name": "Handle", "value": "0x000004ce" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}" } ], "repeated": 0, "id": 2267 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType" } ], "repeated": 0, "id": 2268 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server" } ], "repeated": 0, "id": 2269 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004ce" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004d2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2270 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath" } ], "repeated": 0, "id": 2271 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading" } ], "repeated": 0, "id": 2272 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2273 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel" } ], "repeated": 0, "id": 2274 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004ce" } ], "repeated": 0, "id": 2275 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004c8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes" } ], "repeated": 0, "id": 2276 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer" } ], "repeated": 0, "id": 2277 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser" } ], "repeated": 0, "id": 2278 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2279 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2280 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions" } ], "repeated": 0, "id": 2281 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2282 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2283 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xbc#\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9148" } ], "repeated": 0, "id": 2284 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 2285 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Security.Cryptography.Core.HashAlgorithmProvider" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider" } ], "repeated": 0, "id": 2286 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c8" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc2\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00Pk\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\"\\xffde\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90U\nAF\\x02\\x00\\x00x\\xff93\\x08AF\\x02\\x00\\x00P\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00Pk\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff93\\x08AF\\x02\\x00\\x00Pk\\x08AF\\x02\\x00\\x00\\xff90U\nAF\\x02\\x00\\x00\\xfff0\\xff85\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90U\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pk\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`3\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00Pk\\x08AF\\x02\\x00\\x00\\xfff0\\xff85\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc3\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x109\nAF\\x02\\x00\\x00P\\xff93\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2287 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType" } ], "repeated": 0, "id": 2288 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server" } ], "repeated": 0, "id": 2289 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\CryptoWinRT.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath" } ], "repeated": 0, "id": 2290 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading" } ], "repeated": 0, "id": 2291 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel" } ], "repeated": 0, "id": 2292 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004c8" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes" } ], "repeated": 0, "id": 2293 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer" } ], "repeated": 0, "id": 2294 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser" } ], "repeated": 0, "id": 2295 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2296 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2297 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions" } ], "repeated": 0, "id": 2298 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c8" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2299 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c8" } ], "repeated": 0, "id": 2300 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000001ac" }, { "name": "HandleName", "value": "\\Device\\KsecDD" }, { "name": "IoControlCode", "value": "0x00390400" }, { "name": "InputBuffer", "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2301 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "bcryptprimitives.dll" }, { "name": "ModuleHandle", "value": "0x7fff57ef0000" }, { "name": "FunctionName", "value": "GetHashInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57f04460" } ], "repeated": 0, "id": 2302 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "Expiration" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration" } ], "repeated": 0, "id": 2303 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 2304 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Core.CoreApplication" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication" } ], "repeated": 0, "id": 2305 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004c4" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xff9d\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc5\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00b\\xffa3\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90T\nAF\\x02\\x00\\x00x\\xff9d\\x08AF\\x02\\x00\\x00P\\xff9d\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9d\\x08AF\\x02\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00\\xff90T\nAF\\x02\\x00\\x00`\\xff84\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90T\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`3\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00`\\xff84\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc6\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff905\nAF\\x02\\x00\\x00P\\xff9d\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2306 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType" } ], "repeated": 0, "id": 2307 }, { "timestamp": "2026-05-29 01:19:08,087", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server" } ], "repeated": 0, "id": 2308 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\twinapi.appcore.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath" } ], "repeated": 0, "id": 2309 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading" } ], "repeated": 0, "id": 2310 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel" } ], "repeated": 0, "id": 2311 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004c4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes" } ], "repeated": 0, "id": 2312 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer" } ], "repeated": 0, "id": 2313 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser" } ], "repeated": 0, "id": 2314 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2315 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2316 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions" } ], "repeated": 0, "id": 2317 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004c4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2318 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004c4" } ], "repeated": 0, "id": 2319 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410a1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2320 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:230c1dcef09253fc167" } ], "repeated": 0, "id": 2321 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 2322 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 2323 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410b1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2324 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410b2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2325 }, { "timestamp": "2026-05-29 01:19:08,103", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000414" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 2326 }, { "timestamp": "2026-05-29 01:19:08,431", "thread_id": "672", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "__notification__", "api": "__anomaly__", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadIdentifier", "value": "672" }, { "name": "Subcategory", "value": "unhook" }, { "name": "FunctionName", "value": "CommandLineToArgvW" }, { "name": "FunctionAddress", "value": "0x7fff5808eb30" }, { "name": "UnhookType", "value": "restored" } ], "repeated": 0, "id": 2327 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f13000" }, { "name": "RegionSize", "value": "0x00021000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2328 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f56000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2329 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f5a000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2330 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f5d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2331 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f5f000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2332 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f62000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2333 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f64000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2334 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f67000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2335 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f6a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2336 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f6c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2337 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f70000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2338 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f74000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2339 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f78000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2340 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24642f83000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2341 }, { "timestamp": "2026-05-29 01:19:08,947", "thread_id": "8784", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24646c10000" }, { "name": "RegionSize", "value": "0x0008f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2342 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff5181f406", "parentcaller": "0x7fff517e0733", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2343 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.PropertySet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet" } ], "repeated": 0, "id": 2344 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004d0" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xff9b\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffed\\xffcf\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00P\\xff96\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x02\\xff8b\\xffd2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0P\nAF\\x02\\x00\\x00x\\xff9b\\x08AF\\x02\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00P\\xff96\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00P\\xff96\\x08AF\\x02\\x00\\x00\\xffd0P\nAF\\x02\\x00\\x00`\\xff84\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0P\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00`3\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff96\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`3\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00P\\xff96\\x08AF\\x02\\x00\\x00`\\xff84\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffee\\xffcf\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`:\nAF\\x02\\x00\\x00P\\xff9b\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2345 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType" } ], "repeated": 0, "id": 2346 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server" } ], "repeated": 0, "id": 2347 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath" } ], "repeated": 0, "id": 2348 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading" } ], "repeated": 0, "id": 2349 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel" } ], "repeated": 0, "id": 2350 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004d0" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes" } ], "repeated": 0, "id": 2351 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer" } ], "repeated": 0, "id": 2352 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser" } ], "repeated": 0, "id": 2353 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2354 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2355 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions" } ], "repeated": 0, "id": 2356 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004d0" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2357 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004d0" } ], "repeated": 0, "id": 2358 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 2359 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52dc0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2360 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dc9590" } ], "repeated": 0, "id": 2361 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dc90f0" } ], "repeated": 0, "id": 2362 }, { "timestamp": "2026-05-29 01:19:10,150", "thread_id": "8072", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "ModuleHandle", "value": "0x7fff52dc0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52dd47b0" } ], "repeated": 0, "id": 2363 }, { "timestamp": "2026-05-29 01:19:10,165", "thread_id": "8072", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52efd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2364 }, { "timestamp": "2026-05-29 01:19:10,165", "thread_id": "8072", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52efd000" }, { "name": "ModuleName", "value": "wintypes.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2365 }, { "timestamp": "2026-05-29 01:19:10,165", "thread_id": "8072", "caller": "0x7fff517e91f4", "parentcaller": "0x7fff517e8d56", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2366 }, { "timestamp": "2026-05-29 01:19:10,165", "thread_id": "8072", "caller": "0x7fff517e926f", "parentcaller": "0x7fff517e8d56", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0Q\tAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`R\tAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80R\tAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94S\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8S\tAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0S\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0S\tAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8S\tAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8S\tAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0R\tAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006S\tAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff94\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe3\\xffdf\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00`:\nAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00r\\xff81\\xffc2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10b\\x03AF\\x02\\x00\\x00\\xfff8\\xff94\\x08AF\\x02\\x00\\x00\\xffd0\\xff94\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00`:\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff94\\x08AF\\x02\\x00\\x00`:\nAF\\x02\\x00\\x00\\x10b\\x03AF\\x02\\x00\\x00\\xffd0\\xff82\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10b\\x03AF\\x02\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`:\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00`:\nAF\\x02\\x00\\x00\\xffd0\\xff82\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffe4\\xffdf\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\xffd0\\xff94\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2502 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType" } ], "repeated": 0, "id": 2503 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\biwinrt.dll" }, { "name": "BaseAddress", "value": "0x7fff3d7b0000" } ], "repeated": 0, "id": 2504 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d7b0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\biwinrt.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 2505 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004f4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes" } ], "repeated": 0, "id": 2506 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ExePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath" } ], "repeated": 0, "id": 2507 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "biwinrt.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d7b0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d7bee10" } ], "repeated": 0, "id": 2508 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2509 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType" } ], "repeated": 0, "id": 2510 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2511 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions" } ], "repeated": 0, "id": 2512 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions" } ], "repeated": 0, "id": 2513 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2514 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410b6000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2515 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000504" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000478" }, { "name": "ObjectAttributesName", "value": "UserManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager" } ], "repeated": 0, "id": 2516 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000508" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.ApplicationModel.Background.BackgroundWorkManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager" } ], "repeated": 0, "id": 2517 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName" } ], "repeated": 0, "id": 2518 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "IdentityType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType" } ], "repeated": 0, "id": 2519 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000508" }, { "name": "KeyInformation", "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00r\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00W\\x00o\\x00r\\x00k\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00zX\\xffff\\x7f\\x00\\x00x\\xffa5\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffd7\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\x02\nAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x12\\xffb5\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10[\nAF\\x02\\x00\\x00x\\xffa5\\x08AF\\x02\\x00\\x00P\\xffa5\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\x02\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa5\\x08AF\\x02\\x00\\x00\\xffd0\\x02\nAF\\x02\\x00\\x00\\x10[\nAF\\x02\\x00\\x00\\xffb0\\xff8e\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10[\nAF\\x02\\x00\\x00P>\nAF\\x02\\x00\\x00P>\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x02\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P>\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\x02\nAF\\x02\\x00\\x00\\xffb0\\xff8e\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffd8\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x000?\nAF\\x02\\x00\\x00P\\xffa5\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2520 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 2521 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58579d80", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ActivatableClasses" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses" } ], "repeated": 0, "id": 2522 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 2523 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server" } ], "repeated": 0, "id": 2524 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ServerType" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType" } ], "repeated": 0, "id": 2525 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641098000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2526 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "AppId" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId" } ], "repeated": 0, "id": 2527 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\biwinrt.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath" } ], "repeated": 0, "id": 2528 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "Identity" }, { "name": "Data", "value": "nt authority\\system" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity" } ], "repeated": 0, "id": 2529 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading" } ], "repeated": 0, "id": 2530 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ServiceName" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName" } ], "repeated": 0, "id": 2531 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000504" }, { "name": "ValueName", "value": "ExplicitPsmActivationType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType" } ], "repeated": 0, "id": 2532 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000504" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes" } ], "repeated": 0, "id": 2533 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer" } ], "repeated": 0, "id": 2534 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser" } ], "repeated": 0, "id": 2535 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2536 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2537 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions" } ], "repeated": 0, "id": 2538 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000508" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2539 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2540 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2541 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410c9000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2542 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410cc000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2543 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 1, "id": 2544 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" }, { "name": "Handle", "value": "0x000004f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}" } ], "repeated": 0, "id": 2545 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2546 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004f6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2547 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2548 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2549 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2550 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" } ], "repeated": 0, "id": 2551 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050a" } ], "repeated": 0, "id": 2552 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff5854fae4", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2553 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f6" } ], "repeated": 0, "id": 2554 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2555 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2556 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2557 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2558 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2559 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xba\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xf0\\xbb\\xdf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2560 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\xc0\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00 \\xc1\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2561 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2562 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 2563 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2564 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\xbe\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xc0\\xbf\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2565 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2566 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2567 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "ValueName", "value": "" }, { "name": "Type", "value": "1", "pretty_value": "REG_SZ" }, { "name": "Information", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2568 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2569 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2570 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2571 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2572 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2573 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2574 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xbe\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x02\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x000\\xbf\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2575 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xfe\\x05AF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2576 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" } ], "repeated": 0, "id": 2577 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2578 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffff80000005", "pretty_return": "BUFFER_OVERFLOW", "arguments": [ { "name": "KeyHandle", "value": "0x00000502" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2579 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0{\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xd6\\xef\"q\\x00\\x00\\x00\\x04\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2580 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2581 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0q\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2582 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2583 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18G\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2584 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2585 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2586 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8s\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2587 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2588 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xbe\\xa3|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xd5\\xef\"q\\x00\\x00\\x00H\\xd5\\xef\"q\\x00\\x00\\x00\\x18\\xd5\\xef\"q\\x00\\x00\\x008\\xd5\\xef\"" } ], "repeated": 0, "id": 2589 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0s\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd3\\xef\"q\\x00\\x00\\x00\\x04\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2590 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000508" } ], "repeated": 0, "id": 2591 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2592 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2593 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" } ], "repeated": 0, "id": 2594 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32" } ], "repeated": 0, "id": 2595 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbe\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xb0\\xbf\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2596 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2597 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}" } ], "repeated": 0, "id": 2598 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2599 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2600 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2601 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000506" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000004a6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2602 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2603 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2604 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2605 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2606 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2607 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2608 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2609 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2610 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xbc\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xbd\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2611 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2612 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2613 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x80\\xb9\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\x80\\xba\\xdf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2614 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000004a4" } ], "repeated": 0, "id": 2615 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2616 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2617 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2618 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00|\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2619 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2620 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2621 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08N\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2622 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2623 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x1e\\xbf|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf0\\xd8\\xef\"q\\x00\\x00\\x00\\xe8\\xd8\\xef\"q\\x00\\x00\\x00\\xb8\\xd8\\xef\"q\\x00\\x00\\x00\\xd8\\xd8\\xef\"" } ], "repeated": 0, "id": 2624 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f6" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2625 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0y\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00F\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xcfmX\\xff\\x7f\\x00\\x00\\x88\\xcfmX\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2626 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2627 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88O\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2628 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2629 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2630 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2631 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000504" } ], "repeated": 0, "id": 2632 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2633 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2634 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2635 }, { "timestamp": "2026-05-29 01:19:10,197", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows.System.User.ProxyStubFactory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2636 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2637 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2638 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2639 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2640 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff50f81000" }, { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2641 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2642 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004e6" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2643 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2644 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2645 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000502" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2646 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000502" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2647 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\xba\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x02\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xa0\\xbb\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2648 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32" } ], "repeated": 0, "id": 2649 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)" } ], "repeated": 0, "id": 2650 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xbb\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xbc\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2651 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d09b4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2652 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32" } ], "repeated": 0, "id": 2653 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb6\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00P\\xb7\\xdf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2654 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2655 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d09f7", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2656 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2657 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2658 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xbb\\xaf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xbc\\xaf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2659 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2660 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2661 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004f6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2662 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32" } ], "repeated": 0, "id": 2663 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004f6" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID" } ], "repeated": 0, "id": 2664 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 2665 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2666 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004f6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2667 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004f6" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2668 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2669 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Foundation.Collections.ValueSet" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet" } ], "repeated": 0, "id": 2670 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\usermgrproxy.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 2671 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000502" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" } ], "repeated": 0, "id": 2672 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000502" } ], "repeated": 0, "id": 2673 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType" } ], "repeated": 0, "id": 2674 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f6" } ], "repeated": 0, "id": 2675 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 2676 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff584d855f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2677 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2678 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath" } ], "repeated": 0, "id": 2679 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x000004f6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2680 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xb6\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00@\\xb7\\xdf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2681 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004f6" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs" } ], "repeated": 0, "id": 2682 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel" } ], "repeated": 0, "id": 2683 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004e6" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler" } ], "repeated": 0, "id": 2684 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\xb5\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xe6\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xb6\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2685 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes" } ], "repeated": 0, "id": 2686 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2687 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer" } ], "repeated": 0, "id": 2688 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e6" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID" } ], "repeated": 0, "id": 2689 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2690 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2691 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\usermgrproxy" }, { "name": "DllBase", "value": "0x7fff4f6e0000" } ], "repeated": 0, "id": 2692 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2693 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004e6" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer" } ], "repeated": 0, "id": 2694 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataWriter" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter" } ], "repeated": 0, "id": 2695 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xffff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffa8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffda\\xffef\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00b\\xffb6\\xfff2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90]\nAF\\x02\\x00\\x00x\\xffa8\\x08AF\\x02\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\xff90]\nAF\\x02\\x00\\x000\\xff8c\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90]\nAF\\x02\\x00\\x00pf\\x0bAF\\x02\\x00\\x00pf\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pf\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00@d\\x0bAF\\x02\\x00\\x000\\xff8c\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffdb\\xffef\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 l\\x0bAF\\x02\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2696 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } ], "repeated": 0, "id": 2697 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000050e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2698 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000050e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2699 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath" } ], "repeated": 0, "id": 2700 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xf0\\xb6\\xdf\"q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x0e\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xf0\\xb7\\xdf\"q\\x00\\x00\\x00" } ], "repeated": 0, "id": 2701 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" } ], "repeated": 0, "id": 2702 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading" } ], "repeated": 0, "id": 2703 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000050e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2704 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x0000050e" }, { "name": "ObjectAttributesName", "value": "Elevation" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation" } ], "repeated": 0, "id": 2705 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel" } ], "repeated": 0, "id": 2706 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2707 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes" } ], "repeated": 0, "id": 2708 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer" } ], "repeated": 0, "id": 2709 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser" } ], "repeated": 0, "id": 2710 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2711 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2712 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2713 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions" } ], "repeated": 0, "id": 2714 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2715 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff58557226", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2716 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}" }, { "name": "Handle", "value": "0x00000506" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}" } ], "repeated": 0, "id": 2717 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000506" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2718 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000516" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2719 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2720 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2721 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000506" } ], "repeated": 0, "id": 2722 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2723 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2724 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000516" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2725 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff52de1f48", "parentcaller": "0x7fff52de26b1", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2726 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000516" } ], "repeated": 0, "id": 2727 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d7ff000" }, { "name": "ModuleName", "value": "biwinrt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2728 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d7ff000" }, { "name": "ModuleName", "value": "biwinrt.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2729 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2730 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.Streams.DataReader" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader" } ], "repeated": 0, "id": 2731 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00R\\x00e\\x00a\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00P\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x004\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd6\\xffef\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\"\\xffb2\\xfff2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0<\\x06AF\\x02\\x00\\x00x\\xffad\\x08AF\\x02\\x00\\x00P\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffad\\x08AF\\x02\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\xffd0<\\x06AF\\x02\\x00\\x00\\xffa0\\xff8a\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0<\\x06AF\\x02\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0=\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00=\nAF\\x02\\x00\\x00\\xffa0\\xff8a\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd7\\xffef\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00@4\nAF\\x02\\x00\\x00P\\xffad\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2732 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType" } ], "repeated": 0, "id": 2733 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server" } ], "repeated": 0, "id": 2734 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\WinTypes.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath" } ], "repeated": 0, "id": 2735 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading" } ], "repeated": 0, "id": 2736 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel" } ], "repeated": 0, "id": 2737 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000004a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes" } ], "repeated": 0, "id": 2738 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer" } ], "repeated": 0, "id": 2739 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser" } ], "repeated": 0, "id": 2740 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2741 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2742 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions" } ], "repeated": 0, "id": 2743 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004a4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2744 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004a4" } ], "repeated": 0, "id": 2745 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464110a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2746 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 1, "id": 2747 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2748 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" }, { "name": "Handle", "value": "0x0000051a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}" } ], "repeated": 0, "id": 2749 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff58551dfa", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2750 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000051a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2751 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2752 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" } ], "repeated": 0, "id": 2753 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" } ], "repeated": 0, "id": 2754 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2755 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2756 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" }, { "name": "Handle", "value": "0x00000522" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}" } ], "repeated": 0, "id": 2757 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x8c\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x08\\x1c\\xe4R\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2758 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@r\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2759 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2760 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "h\\xbb\\x02AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2761 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2762 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "Xs\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2763 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xde\\xa9|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x000\\xcf\\xef\"q\\x00\\x00\\x00(\\xcf\\xef\"q\\x00\\x00\\x00\\xf8\\xce\\xef\"q\\x00\\x00\\x00\\x18\\xcf\\xef\"" } ], "repeated": 0, "id": 2764 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Ps\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd\\xef\"q\\x00\\x00\\x00\\x1c\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2765 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000522" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2766 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8O\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2767 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2768 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8s\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2769 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00~\\xac|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x90\\xcb\\xef\"q\\x00\\x00\\x00\\x88\\xcb\\xef\"q\\x00\\x00\\x00X\\xcb\\xef\"q\\x00\\x00\\x00x\\xcb\\xef\"" } ], "repeated": 0, "id": 2770 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0s\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc9\\xef\"q\\x00\\x00\\x00\\x1c\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2771 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2772 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2773 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2774 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 2775 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2776 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000522" } ], "repeated": 0, "id": 2777 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2778 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2779 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2780 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" }, { "name": "Handle", "value": "0x0000051e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}" } ], "repeated": 0, "id": 2781 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff4315dc24", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004f0" } ], "repeated": 0, "id": 2782 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000051e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2783 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410cf000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2784 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464109b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2785 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2786 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2787 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" } ], "repeated": 0, "id": 2788 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" } ], "repeated": 0, "id": 2789 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2790 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2791 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2792 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000051c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2793 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000518" } ], "repeated": 0, "id": 2794 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2795 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x8c\nAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2796 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0w\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x92m\\x05\\xa4\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xd0z\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2797 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2798 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88C\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2799 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2800 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "8x\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2801 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x1e\\xbf|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf0\\xd8\\xef\"q\\x00\\x00\\x00\\xe8\\xd8\\xef\"q\\x00\\x00\\x00\\xb8\\xd8\\xef\"q\\x00\\x00\\x00\\xd8\\xd8\\xef\"" } ], "repeated": 0, "id": 2802 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000x\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xd6\\xef\"q\\x00\\x00\\x00\\x18\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2803 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2804 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88\\xf2\\x0cAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2805 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@u\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xcfmX\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0[\\x03A" } ], "repeated": 0, "id": 2806 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2807 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HJ\\x08AF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2808 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "xw\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2809 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pw\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xd3\\xef\"q\\x00\\x00\\x00\\x18\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2810 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 0, "id": 2811 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2812 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2813 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2814 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2815 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" }, { "name": "Handle", "value": "0x0000051a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}" } ], "repeated": 0, "id": 2816 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000051a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2817 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2818 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" } ], "repeated": 0, "id": 2819 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051a" } ], "repeated": 0, "id": 2820 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2821 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2822 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2823 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000518" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 2824 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000051c" } ], "repeated": 0, "id": 2825 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2826 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xf2\\x0cAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2827 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`y\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x92m\\x05\\xa4\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2828 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2829 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8\\x83\\x0bAF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2830 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2831 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98u\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2832 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xde\\xa9|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x000\\xcf\\xef\"q\\x00\\x00\\x00(\\xcf\\xef\"q\\x00\\x00\\x00\\xf8\\xce\\xef\"q\\x00\\x00\\x00\\x18\\xcf\\xef\"" } ], "repeated": 0, "id": 2833 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90u\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd\\xef\"q\\x00\\x00\\x00\\x1c\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2834 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2835 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x88\\xf2\\x0cAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2836 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xc0p\\x0bAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x89dr\r\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2837 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c697", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2838 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2839 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c717", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xc0\\x80\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x008\\x004\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2840 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88\\x83\\x0bAF\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 2841 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d6785", "parentcaller": "0x7fff431516e6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" } ], "repeated": 0, "id": 2842 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2843 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18}\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2844 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00~\\xac|\\xe4D\\xd1\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x90\\xcb\\xef\"q\\x00\\x00\\x00\\x88\\xcb\\xef\"q\\x00\\x00\\x00X\\xcb\\xef\"q\\x00\\x00\\x00x\\xcb\\xef\"" } ], "repeated": 0, "id": 2845 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10}\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc9\\xef\"q\\x00\\x00\\x00\\x1c\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 2846 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2847 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051c" } ], "repeated": 1, "id": 2848 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c697", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2849 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff4315c717", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xa0\\x82\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 2850 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d6785", "parentcaller": "0x7fff431516e6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000518" } ], "repeated": 0, "id": 2851 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2852 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" }, { "name": "Handle", "value": "0x0000051e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}" } ], "repeated": 0, "id": 2853 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2854 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410ca000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2855 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000051e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000516" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2856 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType" } ], "repeated": 0, "id": 2857 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.SecondaryTileView" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView" } ], "repeated": 0, "id": 2858 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xffa8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe3\\xffdf\"q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffe0@\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffc2\\xff80\\xffc2\\xffa0\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb5\\x0bAF\\x02\\x00\\x00x\\xffa8\\x08AF\\x02\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffe0@\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00\\xffe0@\\x0bAF\\x02\\x00\\x00\\xff90\\xffb5\\x0bAF\\x02\\x00\\x00\\xffa0\\xfff5\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb5\\x0bAF\\x02\\x00\\x00pf\\x0bAF\\x02\\x00\\x00pf\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0@\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pf\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffe0@\\x0bAF\\x02\\x00\\x00\\xffa0\\xfff5\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffe4\\xffdf\"q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x000h\\x0bAF\\x02\\x00\\x00P\\xffa8\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 2859 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server" } ], "repeated": 0, "id": 2860 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath" } ], "repeated": 0, "id": 2861 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType" } ], "repeated": 0, "id": 2862 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading" } ], "repeated": 0, "id": 2863 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000514" } ], "repeated": 0, "id": 2864 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2865 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xc8\\xf3\\x0cAF\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00n\\x00t\\x00 \\x00a\\x00u\\x00t\\x00h\\x00o\\x00r\\x00i\\x00t\\x00y\\x00\\\\x00s\\x00y\\x00s\\x00t\\x00e\\x00m\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2866 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath" } ], "repeated": 0, "id": 2867 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000528" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\CustomAttributes" } ], "repeated": 0, "id": 2868 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\xbf[\\x0f\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00e[\\x0f\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 2869 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer" } ], "repeated": 0, "id": 2870 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel" } ], "repeated": 0, "id": 2871 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2872 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8w\\x0bAF\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 2873 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2874 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d3e41", "parentcaller": "0x7fff578543b9", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser" } ], "repeated": 0, "id": 2875 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2876 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker" } ], "repeated": 0, "id": 2877 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2878 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "WindowsGetStringRawBuffer" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584f2340" } ], "repeated": 0, "id": 2879 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions" } ], "repeated": 0, "id": 2880 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000004e4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2881 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2882 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e4" } ], "repeated": 0, "id": 2883 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2884 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410e1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2885 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410e2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2886 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2887 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x7fY\\x8a\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "232" } ], "repeated": 0, "id": 2888 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2889 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf7Y\\x8a\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2890 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 2891 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" }, { "name": "Handle", "value": "0x00000522" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" } ], "repeated": 0, "id": 2892 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}" } ], "repeated": 0, "id": 2893 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xdf[\\x8a\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2894 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2895 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2896 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "2866" } ], "repeated": 0, "id": 2897 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 2898 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2899 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000522" } ], "repeated": 0, "id": 2900 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" } ], "repeated": 0, "id": 2901 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 2902 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2903 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2904 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xbf\\\\x8a\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 2905 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2906 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType" } ], "repeated": 0, "id": 2907 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2908 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server" } ], "repeated": 0, "id": 2909 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath" } ], "repeated": 0, "id": 2910 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath" } ], "repeated": 0, "id": 2911 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading" } ], "repeated": 0, "id": 2912 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer" } ], "repeated": 0, "id": 2913 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser" } ], "repeated": 0, "id": 2914 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer" } ], "repeated": 0, "id": 2915 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000528" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2916 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 2917 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000514" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000052c" } ], "repeated": 0, "id": 2918 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 2919 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions" } ], "repeated": 0, "id": 2920 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000520" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags" } ], "repeated": 0, "id": 2921 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2922 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2923 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x84`\\x8a\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 2924 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410e3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2925 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff59f70880", "parentcaller": "0x7fff59f73008", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410e1000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 2926 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2927 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" }, { "name": "Handle", "value": "0x0000052a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" } ], "repeated": 0, "id": 2928 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000052a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000051e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2929 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2930 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2931 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff5854fad3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000051e" } ], "repeated": 0, "id": 2932 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "820", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2933 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052a" } ], "repeated": 0, "id": 2934 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2935 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2936 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" }, { "name": "Handle", "value": "0x00000522" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}" } ], "repeated": 0, "id": 2937 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000522" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2938 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2939 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 2940 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000522" } ], "repeated": 0, "id": 2941 }, { "timestamp": "2026-05-29 01:19:10,212", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" }, { "name": "Handle", "value": "0x000004e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" } ], "repeated": 0, "id": 2942 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2943 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" }, { "name": "Handle", "value": "0x00000522" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}" } ], "repeated": 0, "id": 2944 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2945 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2946 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2947 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000522" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000526" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2948 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2949 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000526" } ], "repeated": 0, "id": 2950 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000522" } ], "repeated": 0, "id": 2951 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410d0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2952 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410d1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2953 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2954 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "820", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000514" } ], "repeated": 0, "id": 2955 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2956 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 2957 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "4004", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464107b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2958 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x1f\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8072" } ], "repeated": 0, "id": 2959 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "4004", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641082000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2960 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "4004", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24641114000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2961 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2962 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2963 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2964 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2965 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2966 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2967 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "4004", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000226000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2968 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d248a", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 2969 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003a6" }, { "name": "ObjectAttributesName", "value": "Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" } ], "repeated": 0, "id": 2970 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}" } ], "repeated": 0, "id": 2971 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "4004", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2972 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2973 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2974 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2975 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2976 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2977 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2978 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 2979 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000003a6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 2980 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000003a6" }, { "name": "ObjectAttributesName", "value": "Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" } ], "repeated": 0, "id": 2981 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004e4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}" } ], "repeated": 0, "id": 2982 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 2983 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000004e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000050e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2984 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410d4000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2985 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 2986 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000050e" } ], "repeated": 0, "id": 2987 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000004e6" } ], "repeated": 0, "id": 2988 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2989 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 2990 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000500" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x246410bb690" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "7352" }, { "name": "ProcessId", "value": "8972" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 2991 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x00000500", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x246410bb690" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "7352" }, { "name": "ProcessId", "value": "8972" } ], "repeated": 0, "id": 2992 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584fcadc", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 2993 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" }, { "name": "Handle", "value": "0x0000052e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}" } ], "repeated": 0, "id": 2994 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000228000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2995 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640005c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2996 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000052e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000532" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32" } ], "repeated": 0, "id": 2997 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 2998 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x246410bb690" } ], "repeated": 0, "id": 2999 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000538" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3000 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3001 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000532" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3002 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000532" } ], "repeated": 0, "id": 3003 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3004 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "2860" } ], "repeated": 0, "id": 3005 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000052e" } ], "repeated": 0, "id": 3006 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3007 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3008 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "9148", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xbc#\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "9148" } ], "repeated": 0, "id": 3009 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Shell.TaskbarManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager" } ], "repeated": 0, "id": 3010 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffd0\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0t\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xfff2\\xffaf\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10V\nAF\\x02\\x00\\x00\\xfff8\\xff93\\x08AF\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0t\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\xffd0t\\x0bAF\\x02\\x00\\x00\\x10V\nAF\\x02\\x00\\x00\\x00\\xfffa\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10V\nAF\\x02\\x00\\x00\\xff80i\\x0bAF\\x02\\x00\\x00\\xff80i\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0t\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80i\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0t\\x0bAF\\x02\\x00\\x00\\x00\\xfffa\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffd1\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 e\\x0bAF\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3011 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType" } ], "repeated": 0, "id": 3012 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server" } ], "repeated": 0, "id": 3013 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath" } ], "repeated": 0, "id": 3014 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading" } ], "repeated": 0, "id": 3015 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel" } ], "repeated": 0, "id": 3016 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000500" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes" } ], "repeated": 0, "id": 3017 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer" } ], "repeated": 0, "id": 3018 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser" } ], "repeated": 0, "id": 3019 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3020 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3021 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions" } ], "repeated": 0, "id": 3022 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3023 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 3024 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.TaskbarPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface" } ], "repeated": 0, "id": 3025 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000500" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffd0\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00pJ\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xff82\\xffaf\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0S\nAF\\x02\\x00\\x00\\xfff8\\xff93\\x08AF\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00pJ\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00pJ\\x0bAF\\x02\\x00\\x00\\xffd0S\nAF\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0S\nAF\\x02\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pJ\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00pJ\\x0bAF\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffd1\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 e\\x0bAF\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3026 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 3027 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server" } ], "repeated": 0, "id": 3028 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath" } ], "repeated": 0, "id": 3029 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading" } ], "repeated": 0, "id": 3030 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 3031 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000500" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 3032 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 3033 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 3034 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3035 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3036 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions" } ], "repeated": 0, "id": 3037 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000500" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3038 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000500" } ], "repeated": 0, "id": 3039 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8072", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x1f\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8072" } ], "repeated": 0, "id": 3040 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 3041 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\dxgi" }, { "name": "DllBase", "value": "0x7fff55ef0000" } ], "repeated": 0, "id": 3042 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\d3d11" }, { "name": "DllBase", "value": "0x7fff53070000" } ], "repeated": 0, "id": 3043 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\WININET" }, { "name": "DllBase", "value": "0x7fff48b40000" } ], "repeated": 0, "id": 3044 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 26, "id": 3045 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker" }, { "name": "DllBase", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 3046 }, { "timestamp": "2026-05-29 01:19:10,228", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "gdi32.dll" }, { "name": "BaseAddress", "value": "0x7fff58350000" } ], "repeated": 0, "id": 3047 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3048 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "BaseAddress", "value": "0x7fff3d6a0000" } ], "repeated": 0, "id": 3049 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d6a0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3050 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6e1860" } ], "repeated": 0, "id": 3051 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6c2a90" } ], "repeated": 0, "id": 3052 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "windows.internal.shell.broker.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d6a0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d6c03b0" } ], "repeated": 0, "id": 3053 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3054 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3055 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3056 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3057 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3058 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3059 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3060 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3061 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3062 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3063 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3064 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3065 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3066 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 3067 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" } ], "repeated": 0, "id": 3068 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 3069 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000544" } ], "repeated": 0, "id": 3070 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3071 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3072 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3073 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3074 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "4004", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000554" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3075 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "6500", "caller": "0x7fff1773bafb", "parentcaller": "0x7fff1773b4af", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x91000105000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3076 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "6500", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6000229000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3077 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3078 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3079 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "6500", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3080 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x24641002340" } ], "repeated": 0, "id": 3081 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" }, { "name": "Handle", "value": "0x0000054e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}" } ], "repeated": 0, "id": 3082 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3083 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3084 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3085 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" } ], "repeated": 0, "id": 3086 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000054e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3087 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3088 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3089 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xaf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\xb0\\xb0\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3090 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3091 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3092 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3093 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3094 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3095 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3096 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3097 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 3098 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3099 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3100 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3101 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3102 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3103 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3104 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3105 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xae\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00@\\xaf\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3106 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3107 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3108 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3109 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3110 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3111 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xae\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00@\\xaf\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3112 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3113 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3114 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3115 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" } ], "repeated": 0, "id": 3116 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3117 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3118 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000054e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3119 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3120 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3121 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xac\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00p\\xad\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3122 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3123 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3124 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3125 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3126 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3127 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3128 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)" } ], "repeated": 0, "id": 3129 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32" } ], "repeated": 0, "id": 3130 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 3131 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3132 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 3133 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 3134 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3135 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3136 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3137 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xab\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\x00\\xac\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3138 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3139 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3140 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32" } ], "repeated": 0, "id": 3141 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3142 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3143 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xab\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00\\x00\\xac\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3144 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3145 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3146 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler" } ], "repeated": 0, "id": 3147 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32" } ], "repeated": 0, "id": 3148 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000054e" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID" } ], "repeated": 0, "id": 3149 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3150 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3151 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xaa\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00N\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00@\\xab\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3152 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 3153 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000054e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3154 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000054e" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer" } ], "repeated": 0, "id": 3155 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3156 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000055a" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation" } ], "repeated": 0, "id": 3157 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3158 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" } ], "repeated": 0, "id": 3159 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" }, { "name": "Handle", "value": "0x0000054e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } ], "repeated": 0, "id": 3160 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000054e" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs" } ], "repeated": 0, "id": 3161 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054e" } ], "repeated": 0, "id": 3162 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3163 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3164 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff43060000" } ], "repeated": 0, "id": 3165 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff43060000" } ], "repeated": 0, "id": 3166 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff43060000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3167 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43061660" } ], "repeated": 0, "id": 3168 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 3169 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "PCShellCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff43060000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff430616a0" } ], "repeated": 0, "id": 3170 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "6500", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000560" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3171 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3172 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3173 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3174 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3175 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3176 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3177 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3178 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3179 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3180 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000540" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3181 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000540" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3182 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3183 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3184 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3185 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3186 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 3187 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000054c" } ], "repeated": 0, "id": 3188 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000540" } ], "repeated": 0, "id": 3189 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000540" } ], "repeated": 0, "id": 3190 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3191 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410e3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3192 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00P\\x10\\x0eAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xf0\\x10\\x0eAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x11\\x0eAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00$\\x12\\x0eAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x12\\x0eAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00@\\x12\\x0eAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x12\\x0eAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00h\\x12\\x0eAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\x12\\x0eAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00@\\x11\\x0eAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\xc6\\x11\\x0eAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\xcc\\x11\\x0eAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 3193 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.UI.StartScreen.StartScreenManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager" } ], "repeated": 0, "id": 3194 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffa3\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc8\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffa2\\xffa7\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffb3\\x0bAF\\x02\\x00\\x00\\xfff8\\xffa3\\x08AF\\x02\\x00\\x00\\xffd0\\xffa3\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffa3\\x08AF\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x10\\xffb3\\x0bAF\\x02\\x00\\x00\\xff90\\xfff6\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffb3\\x0bAF\\x02\\x00\\x00@d\\x0bAF\\x02\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@d\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff93\\x08AF\\x02\\x00\\x00\\xff90\\xfff6\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc9\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 l\\x0bAF\\x02\\x00\\x00\\xffd0\\xffa3\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3195 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType" } ], "repeated": 0, "id": 3196 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server" } ], "repeated": 0, "id": 3197 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath" } ], "repeated": 0, "id": 3198 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading" } ], "repeated": 0, "id": 3199 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel" } ], "repeated": 0, "id": 3200 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000558" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes" } ], "repeated": 0, "id": 3201 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer" } ], "repeated": 0, "id": 3202 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser" } ], "repeated": 0, "id": 3203 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3204 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3205 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions" } ], "repeated": 0, "id": 3206 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3207 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 3208 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "7352", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3209 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.System.User" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User" } ], "repeated": 0, "id": 3210 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "KeyInformation", "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00&\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc8\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00b\\xffa4\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb5\\x0bAF\\x02\\x00\\x00\\xfff8\\xff91\\x08AF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\xffd0\\xffb5\\x0bAF\\x02\\x00\\x00\\xff90\\xfff6\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffb5\\x0bAF\\x02\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\xff90\\xfff6\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffc9\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10b\\x0bAF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3211 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType" } ], "repeated": 0, "id": 3212 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "UserManager" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server" } ], "repeated": 0, "id": 3213 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath" } ], "repeated": 0, "id": 3214 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading" } ], "repeated": 0, "id": 3215 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel" } ], "repeated": 0, "id": 3216 }, { "timestamp": "2026-05-29 01:19:10,244", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000558" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes" } ], "repeated": 0, "id": 3217 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer" } ], "repeated": 0, "id": 3218 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser" } ], "repeated": 0, "id": 3219 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3220 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3221 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x7100000003" }, { "name": "DataLength", "value": "184" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3222 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions" } ], "repeated": 0, "id": 3223 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3224 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 3225 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3226 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3227 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3228 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}" } ], "repeated": 0, "id": 3229 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000055a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000566" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3230 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000566" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3231 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000566" } ], "repeated": 0, "id": 3232 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3233 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3234 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3235 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" }, { "name": "Handle", "value": "0x0000056a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}" } ], "repeated": 0, "id": 3236 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000056a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000056e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3237 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3238 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056e" } ], "repeated": 0, "id": 3239 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056a" } ], "repeated": 0, "id": 3240 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3241 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3242 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 3243 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" }, { "name": "Handle", "value": "0x0000055a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}" } ], "repeated": 0, "id": 3244 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000055a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000566" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3245 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000566" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3246 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000566" } ], "repeated": 0, "id": 3247 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000055a" } ], "repeated": 0, "id": 3248 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3249 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3250 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3251 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3252 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3253 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3254 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3255 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3256 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3257 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3258 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3259 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3260 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3261 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.Tiles.TileStore" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore" } ], "repeated": 0, "id": 3262 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000558" }, { "name": "KeyInformation", "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00P\\x008\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffc8\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x000\\xfff2\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x12\\xffa4\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffba\\x0bAF\\x02\\x00\\x00\\xfff8\\xff91\\x08AF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x000\\xfff2\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x000\\xfff2\\x0bAF\\x02\\x00\\x00\\xff90\\xffba\\x0bAF\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffba\\x0bAF\\x02\\x00\\x00\\x00f\\x0bAF\\x02\\x00\\x00\\x00f\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xfff2\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x000\\xfff2\\x0bAF\\x02\\x00\\x00\\xffb0\\xfff4\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffc9\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10b\\x0bAF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3263 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType" } ], "repeated": 0, "id": 3264 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server" } ], "repeated": 0, "id": 3265 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\TileDataRepository.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath" } ], "repeated": 0, "id": 3266 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading" } ], "repeated": 0, "id": 3267 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel" } ], "repeated": 0, "id": 3268 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000558" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes" } ], "repeated": 0, "id": 3269 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer" } ], "repeated": 0, "id": 3270 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser" } ], "repeated": 0, "id": 3271 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3272 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3273 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions" } ], "repeated": 0, "id": 3274 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3275 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" } ], "repeated": 0, "id": 3276 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3277 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3278 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3279 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3280 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3281 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3282 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3283 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3284 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3285 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3286 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3287 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3288 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000434" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3289 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3290 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\x83\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3291 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000568" } ], "repeated": 0, "id": 3292 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3293 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3294 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3295 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3296 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3297 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3298 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3299 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3300 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3301 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000570" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.StateRepository.TileView" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView" } ], "repeated": 0, "id": 3302 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000570" }, { "name": "KeyInformation", "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00;\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc3\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffc2\\xffa0\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb9\\x0bAF\\x02\\x00\\x00\\xfff8\\xffad\\x08AF\\x02\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\xff90\\xffb9\\x0bAF\\x02\\x00\\x00P\\xfff0\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffb9\\x0bAF\\x02\\x00\\x00\\xffc00\nAF\\x02\\x00\\x00\\xffc00\nAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc00\nAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xff91\\x08AF\\x02\\x00\\x00P\\xfff0\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc4\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x109\nAF\\x02\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3303 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType" } ], "repeated": 0, "id": 3304 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "Server" }, { "name": "Data", "value": "StateRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server" } ], "repeated": 0, "id": 3305 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "DllPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath" } ], "repeated": 0, "id": 3306 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "Threading" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading" } ], "repeated": 0, "id": 3307 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel" } ], "repeated": 0, "id": 3308 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000570" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes" } ], "repeated": 0, "id": 3309 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer" } ], "repeated": 0, "id": 3310 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser" } ], "repeated": 0, "id": 3311 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3312 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3313 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions" } ], "repeated": 0, "id": 3314 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000570" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3315 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000570" } ], "repeated": 0, "id": 3316 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3317 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3318 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3319 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" }, { "name": "Handle", "value": "0x0000056e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}" } ], "repeated": 0, "id": 3320 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000056e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000572" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3321 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000572" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3322 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000572" } ], "repeated": 0, "id": 3323 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056e" } ], "repeated": 0, "id": 3324 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3325 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3326 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x0000056c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 3327 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410c0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3328 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056c" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 3329 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056c" } ], "repeated": 0, "id": 3330 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000056c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:230c1dcef09253fc167" } ], "repeated": 0, "id": 3331 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000056c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645fc0000" }, { "name": "SectionOffset", "value": "0x7121afcec0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3332 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645700000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3333 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3334 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645703000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3335 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645fc0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 3336 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000056c" } ], "repeated": 0, "id": 3337 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645702000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 3338 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410c1000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3339 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "MutexName", "value": "Local\\SM0:8972:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3340 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3341 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3342 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3343 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3344 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3345 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000057c" } ], "repeated": 0, "id": 3346 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000578" } ], "repeated": 0, "id": 3347 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3348 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3349 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000574" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface" } ], "repeated": 0, "id": 3350 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000574" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00l\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00\\xfff8\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc7\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00]\\x0bAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffb2\\xffa4\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\nAF\\x02\\x00\\x00\\xfff8\\xffad\\x08AF\\x02\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00]\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00\\x00]\\x0bAF\\x02\\x00\\x00\\xffd0^\nAF\\x02\\x00\\x00\\xff80\\xfff7\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\nAF\\x02\\x00\\x00\\x10i\\x0bAF\\x02\\x00\\x00\\x10i\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00]\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10i\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x00]\\x0bAF\\x02\\x00\\x00\\xff80\\xfff7\\x0cAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc8\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pg\\x0bAF\\x02\\x00\\x00\\xffd0\\xffad\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3351 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType" } ], "repeated": 0, "id": 3352 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server" } ], "repeated": 0, "id": 3353 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath" } ], "repeated": 0, "id": 3354 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading" } ], "repeated": 0, "id": 3355 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel" } ], "repeated": 0, "id": 3356 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000574" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes" } ], "repeated": 0, "id": 3357 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer" } ], "repeated": 0, "id": 3358 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser" } ], "repeated": 0, "id": 3359 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3360 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3361 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions" } ], "repeated": 0, "id": 3362 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000574" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3363 }, { "timestamp": "2026-05-29 01:19:10,259", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000574" } ], "repeated": 0, "id": 3364 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\USERENV" }, { "name": "DllBase", "value": "0x7fff57520000" } ], "repeated": 0, "id": 3365 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 3366 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\windows.storage" }, { "name": "DllBase", "value": "0x7fff55710000" } ], "repeated": 0, "id": 3367 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Bcp47Langs" }, { "name": "DllBase", "value": "0x7fff4c520000" } ], "repeated": 0, "id": 3368 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\StartTileData" }, { "name": "DllBase", "value": "0x7fff43dd0000" } ], "repeated": 0, "id": 3369 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "BaseAddress", "value": "0x7fff43dd0000" } ], "repeated": 0, "id": 3370 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff43dd0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\StartTileData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3371 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43ea7f30" } ], "repeated": 0, "id": 3372 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43e82270" } ], "repeated": 0, "id": 3373 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "StartTileData.dll" }, { "name": "ModuleHandle", "value": "0x7fff43dd0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff43e9a890" } ], "repeated": 0, "id": 3374 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x000005a8" } ], "repeated": 0, "id": 3375 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3376 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a8" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 3377 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000005a8" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 3378 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcc\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 3379 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a8" } ], "repeated": 0, "id": 3380 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3381 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3382 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3383 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3384 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3385 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3386 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3387 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3388 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3389 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3390 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3391 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3392 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3393 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3394 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ac" } ], "repeated": 0, "id": 3395 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3396 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3397 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b0" } ], "repeated": 0, "id": 3398 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00?F\\x8b\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 3399 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3400 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3401 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3402 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3403 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3404 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3405 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3406 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3407 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000380" }, { "name": "ObjectAttributesName", "value": "Windows.Storage.ApplicationData" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData" } ], "repeated": 0, "id": 3408 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005a4" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00D\\x00a\\x00t\\x00a\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00p\\x00P\\x008\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00x\\xff90\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffcd\\xffaf!q\\x00\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xffd1\\x0fAF\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffa2\\xffaa\\xffb2\\xffa3\\xffdeF\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0g\\x0eAF\\x02\\x00\\x00x\\xff90\\x08AF\\x02\\x00\\x00P\\xff90\\x08AF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\xffd0\\xffd1\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff90\\x08AF\\x02\\x00\\x00\\xffd0\\xffd1\\x0fAF\\x02\\x00\\x00\\xffd0g\\x0eAF\\x02\\x00\\x00\\xff90\\xfff6\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0g\\x0eAF\\x02\\x00\\x00\\xffc0`\\x0bAF\\x02\\x00\\x00\\xffc0`\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd1\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0`\\x0bAF\\x02\\x00\\x00\\xff8c\\xffc2\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\xffd0\\xffd1\\x0fAF\\x02\\x00\\x00\\xff90\\xfff6\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffce\\xffaf!q\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0g\\x0bAF\\x02\\x00\\x00P\\xff90\\x08AF\\x02\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 3409 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType" } ], "repeated": 0, "id": 3410 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server" } ], "repeated": 0, "id": 3411 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath" } ], "repeated": 0, "id": 3412 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading" } ], "repeated": 0, "id": 3413 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel" } ], "repeated": 0, "id": 3414 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005a4" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes" } ], "repeated": 0, "id": 3415 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer" } ], "repeated": 0, "id": 3416 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser" } ], "repeated": 0, "id": 3417 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker" } ], "repeated": 0, "id": 3418 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 3419 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions" } ], "repeated": 0, "id": 3420 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005a4" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags" } ], "repeated": 0, "id": 3421 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005a4" } ], "repeated": 0, "id": 3422 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData" }, { "name": "DllBase", "value": "0x7fff3d810000" } ], "repeated": 0, "id": 3423 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "BaseAddress", "value": "0x7fff3d810000" } ], "repeated": 0, "id": 3424 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff3d810000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 3425 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d834340" } ], "repeated": 0, "id": 3426 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d8220a0" } ], "repeated": 0, "id": 3427 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "ModuleHandle", "value": "0x7fff3d810000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff3d8240a0" } ], "repeated": 0, "id": 3428 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 3429 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "7352", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3430 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "7352", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3431 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "7352", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3432 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "7352", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3433 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xd6\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00F\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3434 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3435 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3436 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" }, { "name": "MutexName", "value": "Local\\SM0:8972:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3437 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3438 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3439 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3440 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3441 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3442 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" } ], "repeated": 0, "id": 3443 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b8" } ], "repeated": 0, "id": 3444 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" } ], "repeated": 0, "id": 3445 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" } ], "repeated": 0, "id": 3446 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3447 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3448 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3449 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3450 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3451 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000005b4" } ], "repeated": 0, "id": 3452 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3453 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005b4" } ], "repeated": 0, "id": 3454 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3455 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "DesiredAccess", "value": "0x02000000", "pretty_value": "MAXIMUM_ALLOWED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER" }, { "name": "ObjectAttributes", "value": "HKEY_USERS" } ], "repeated": 0, "id": 3456 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 0, "id": 3457 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3458 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005bc" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005b8" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR" } ], "repeated": 0, "id": 3459 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" }, { "name": "ValueName", "value": "WnfStateName" }, { "name": "Data", "value": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName" } ], "repeated": 0, "id": 3460 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" } ], "repeated": 0, "id": 3461 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3462 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3463 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005bc" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005b8" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3464 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3465 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3466 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3467 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3468 }, { "timestamp": "2026-05-29 01:19:10,275", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3469 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3470 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3471 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c0" } ], "repeated": 0, "id": 3472 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005bc" } ], "repeated": 0, "id": 3473 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3474 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3475 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3476 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3477 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3478 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3479 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3480 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3481 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3482 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3483 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3484 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3485 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005bc" }, { "name": "DesiredAccess", "value": "0x00000006" }, { "name": "ObjectAttributes", "value": "windows_shell_global_counters" } ], "repeated": 0, "id": 3486 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005bc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645fc0000" }, { "name": "SectionOffset", "value": "0x7121afcc50" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3487 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3488 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58b12000" }, { "name": "ModuleName", "value": "SHLWAPI.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3489 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3490 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c0" }, { "name": "ValueName", "value": "NoPropertiesMyComputer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer" } ], "repeated": 0, "id": 3491 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c0" } ], "repeated": 0, "id": 3492 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3493 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3494 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "NoPropertiesRecycleBin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin" } ], "repeated": 0, "id": 3495 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3496 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3497 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3498 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3499 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3500 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3501 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3502 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3503 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3504 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3505 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 3506 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3507 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3508 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3509 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3510 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3511 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3512 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3513 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3514 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3515 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3516 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "MutexName", "value": "Local\\SM0:8972:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3517 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3518 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3519 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3520 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3521 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3522 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3523 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3524 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3525 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3526 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3527 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "NoControlPanel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" } ], "repeated": 0, "id": 3528 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3529 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3530 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3531 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "NoSetFolders" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders" } ], "repeated": 0, "id": 3532 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3533 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3534 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3535 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "NoInternetIcon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon" } ], "repeated": 0, "id": 3536 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3537 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3538 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe" } ], "repeated": 0, "id": 3539 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3540 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3541 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3542 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3543 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3544 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3545 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3546 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c4" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace" } ], "repeated": 0, "id": 3547 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3548 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3549 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3550 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3551 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005c4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3552 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c4" }, { "name": "ValueName", "value": "NoCommonGroups" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups" } ], "repeated": 0, "id": 3553 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c4" } ], "repeated": 0, "id": 3554 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3555 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3556 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3557 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3558 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3559 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x000005ca" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3560 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3561 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3562 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes" } ], "repeated": 0, "id": 3563 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "CallForAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes" } ], "repeated": 0, "id": 3564 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "RestrictedAttributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes" } ], "repeated": 0, "id": 3565 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" }, { "name": "ValueName", "value": "FolderValueFlags" }, { "name": "Data", "value": "1581568" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags" } ], "repeated": 0, "id": 3566 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ca" } ], "repeated": 0, "id": 3567 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3568 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3569 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3570 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder" } ], "repeated": 0, "id": 3571 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3572 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" }, { "name": "Handle", "value": "0x000005c8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum" } ], "repeated": 0, "id": 3573 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}" } ], "repeated": 0, "id": 3574 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3575 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410ee000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3576 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3577 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3578 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3579 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "ValidateRegItems" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems" } ], "repeated": 0, "id": 3580 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3581 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3582 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3583 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005c8" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace" } ], "repeated": 0, "id": 3584 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005c8" }, { "name": "ValueName", "value": "MonitorRegistry" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry" } ], "repeated": 0, "id": 3585 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005c8" } ], "repeated": 0, "id": 3586 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3587 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3588 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3589 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3590 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410ef000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3591 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3592 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlAreLongPathsEnabled" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fc5280" } ], "repeated": 0, "id": 3593 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3594 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3d872000" }, { "name": "ModuleName", "value": "Windows.Storage.ApplicationData.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3595 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59307000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3596 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59307000" }, { "name": "ModuleName", "value": "SHELL32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3597 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410c5000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3598 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3599 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x000005cc" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 3600 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005cc" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 3601 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3602 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 3603 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 3604 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 3605 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645702000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3606 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 3607 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "MutexName", "value": "Local\\SM0:8972:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 3608 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 3609 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3610 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3611 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3612 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3613 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d4" } ], "repeated": 0, "id": 3614 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d0" } ], "repeated": 0, "id": 3615 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3616 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005cc" } ], "repeated": 0, "id": 3617 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005d0" } ], "repeated": 0, "id": 3618 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3619 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3620 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d0" } ], "repeated": 0, "id": 3621 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005d2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 3622 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d2" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3623 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d2" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 3624 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005d2" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3625 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3626 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x000005d6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 3627 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d6" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3628 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3629 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc6\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xd6\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x000\\xc7\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3630 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3631 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005d6" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3632 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005d6" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3633 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005da" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 3634 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005da" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 3635 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3636 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "0\\xc6\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xda\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x000\\xc7\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 3637 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3638 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005da" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3639 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005da" }, { "name": "ObjectAttributesName", "value": "ShellEx\\LibraryDescriptionHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler" } ], "repeated": 0, "id": 3640 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d2" } ], "repeated": 0, "id": 3641 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005d6" } ], "repeated": 0, "id": 3642 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005da" } ], "repeated": 0, "id": 3643 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x7fff558267d0" }, { "name": "EventName", "value": "Global\\WSearchMigPluginActive" } ], "repeated": 0, "id": 3644 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3645 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3646 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x97!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xa0!\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "8608" } ], "repeated": 0, "id": 3647 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 3648 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3649 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\mssprxy" }, { "name": "DllBase", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 3650 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\mssprxy.dll" }, { "name": "BaseAddress", "value": "0x7fff4cd40000" } ], "repeated": 0, "id": 3651 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff558d8e8e", "parentcaller": "0x7fff558df5f2", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "7D096C5F-AC08-4F1F-BEB7-5C22C517CE39" }, { "name": "ClsContext", "value": "0x00000017", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER" }, { "name": "riid", "value": "AB310581-AC80-11D1-8DF3-00C04FB6EF69" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3652 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3653 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" }, { "name": "Handle", "value": "0x000005e6" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}" } ], "repeated": 0, "id": 3654 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e6" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005ea" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3655 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ea" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3656 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ea" } ], "repeated": 0, "id": 3657 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" } ], "repeated": 0, "id": 3658 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3659 }, { "timestamp": "2026-05-29 01:19:10,290", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3660 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000003a6" }, { "name": "SubKey", "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" }, { "name": "Handle", "value": "0x000005e2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}" } ], "repeated": 0, "id": 3661 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005e2" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000005e6" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32" } ], "repeated": 0, "id": 3662 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 3663 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e6" } ], "repeated": 0, "id": 3664 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005e2" } ], "repeated": 0, "id": 3665 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3666 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 3667 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645704000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3668 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645705000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3669 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 3670 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3671 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3672 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3673 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3674 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3675 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3676 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3677 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3678 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" }, { "name": "BaseAddress", "value": "0x7fff52860000" } ], "repeated": 0, "id": 3679 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3680 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3681 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3682 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 3683 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410f3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3684 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645706000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3685 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 3686 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 3687 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3688 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3689 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3690 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005d0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645fd0000" }, { "name": "SectionOffset", "value": "0x7121afbde0" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3691 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e0" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3692 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e0" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465d600000" }, { "name": "SectionOffset", "value": "0x7121afcd40" }, { "name": "ViewSize", "value": "0x00049000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3693 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3694 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3695 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3696 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3697 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645707000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3698 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3699 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2" } ], "repeated": 0, "id": 3700 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e4" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro" } ], "repeated": 0, "id": 3701 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645fe0000" }, { "name": "SectionOffset", "value": "0x7121afbe90" }, { "name": "ViewSize", "value": "0x00004000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3702 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e8" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" } ], "repeated": 0, "id": 3703 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005e8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465d650000" }, { "name": "SectionOffset", "value": "0x7121afcdf0" }, { "name": "ViewSize", "value": "0x0009c000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3704 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\SysWOW64\\propsys.dll" } ], "repeated": 1, "id": 3705 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtQueryFullAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\propsys.dll" } ], "repeated": 0, "id": 3706 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3707 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3708 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3709 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410f4000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3710 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xb09\\x0fAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00P:\\x0fAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00p:\\x0fAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x84;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98;\\x0fAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xa0;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0;\\x0fAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xc8;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8;\\x0fAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xa0:\\x0fAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00&;\\x0fAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00,;\\x0fAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 3711 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3712 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xb09\\x0fAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00P:\\x0fAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00p:\\x0fAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x84;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98;\\x0fAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xa0;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0;\\x0fAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xc8;\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8;\\x0fAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xa0:\\x0fAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00&;\\x0fAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00,;\\x0fAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 3713 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3714 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3715 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 3716 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x90\\x86\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 3717 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000c" }, { "name": "TokenHandle", "value": "0x000005ec" } ], "repeated": 0, "id": 3718 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3719 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3720 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3721 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005b8" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3722 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ec" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000005b8" }, { "name": "ObjectAttributesName", "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 3723 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3724 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Local AppData" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Local" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData" } ], "repeated": 0, "id": 3725 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3726 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3727 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005f0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001" } ], "repeated": 0, "id": 3728 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3729 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ProfileImagePath" }, { "name": "Data", "value": "C:\\Users\\admin" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath" } ], "repeated": 0, "id": 3730 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3731 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3732 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3733 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3734 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005ec" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3735 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3736 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3737 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3738 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 3739 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000004ac" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 3740 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000004ac" }, { "name": "ObjectAttributesName", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx" } ], "repeated": 0, "id": 3741 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3742 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PackageRepositoryRoot" }, { "name": "Data", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot" } ], "repeated": 0, "id": 3743 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3744 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410f6000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3745 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3746 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3747 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00p$pEF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x00\\xb0\\x00q\\x00\\x00\\x00p$pEF\\x02\\x00\\x00\\xd5,\\xf7Y\\xff\\x7f\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x99\\xbf\\xaf!q\\x00\\x00\\x000\\x00\\x00\\x00q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3748 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3749 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3750 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3751 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3752 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3753 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3754 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3755 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3756 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3757 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3758 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3759 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xd0\\x0fAF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00V\\x00\\x00\\x00\\x00\\x00\\xb0\\xd0\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3760 }, { "timestamp": "2026-05-29 01:19:10,306", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3761 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3762 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3763 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3764 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6@F\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xb7\\x17\\xff\\x7f\\x00\\x00.\\xd0<\\xe7\\x01\\x00\\x00\\x00\\xfeY}W\\xff\\x7f\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\xe8\\xc2\\xaf!q\\x00\\x00\\x00`\\x11\\xb9\\x17\\xff\\x7f\\x00\\x00\\xcdG\\xf7Y\\xff\\x7f\\x00\\x00\\x08\\xae\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\xda\\x17\\xff\\x7f\\x00\\x00\\x8e\\xd3<\\xe7D\\xd1\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xb8\\x17\\xff\\x7f\\x00\\x00\\xe0\\xb5\\xa0BF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3765 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3766 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3767 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3768 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3769 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3770 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3771 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00p\\xf8\\x0fAF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00D\\x00\\x00\\x00\\x00\\x00p\\xf8\\x0fAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3772 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3773 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3774 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3775 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3776 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6@F\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xb7\\x17\\xff\\x7f\\x00\\x00.\\xd0<\\xe7\\x01\\x00\\x00\\x00\\xfeY}W\\xff\\x7f\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\xe8\\xc2\\xaf!q\\x00\\x00\\x00`\\x11\\xb9\\x17\\xff\\x7f\\x00\\x00\\xcdG\\xf7Y\\xff\\x7f\\x00\\x00\\x08\\xae\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\xda\\x17\\xff\\x7f\\x00\\x00\\x8e\\xd3<\\xe7D\\xd1\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xb8\\x17\\xff\\x7f\\x00\\x00\\xe0\\xb5\\xa0BF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3777 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3778 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3779 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3780 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3781 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3782 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3783 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00Pd\\x0eAF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x008\\x00\\x00\\x00\\x00\\x00Pd\\x0eAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3784 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3785 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3786 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3787 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3788 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6@F\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xb7\\x17\\xff\\x7f\\x00\\x00.\\xd0<\\xe7\\x01\\x00\\x00\\x00\\xfeY}W\\xff\\x7f\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\xe8\\xc2\\xaf!q\\x00\\x00\\x00`\\x11\\xb9\\x17\\xff\\x7f\\x00\\x00\\xcdG\\xf7Y\\xff\\x7f\\x00\\x00\\x08\\xae\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\xda\\x17\\xff\\x7f\\x00\\x00\\x8e\\xd3<\\xe7D\\xd1\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xb8\\x17\\xff\\x7f\\x00\\x00\\xe0\\xb5\\xa0BF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3789 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3790 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3791 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3792 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3793 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3794 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3795 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00\\x80\\x86\\x0bAF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00(\\x00\\x00\\x00\\x00\\x00\\x80\\x86\\x0bAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3796 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3797 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3798 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3799 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3800 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6@F\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xb7\\x17\\xff\\x7f\\x00\\x00.\\xd0<\\xe7\\x01\\x00\\x00\\x00\\xfeY}W\\xff\\x7f\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\xe8\\xc2\\xaf!q\\x00\\x00\\x00`\\x11\\xb9\\x17\\xff\\x7f\\x00\\x00\\xcdG\\xf7Y\\xff\\x7f\\x00\\x00\\x08\\xae\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\xda\\x17\\xff\\x7f\\x00\\x00\\x8e\\xd3<\\xe7D\\xd1\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xb8\\x17\\xff\\x7f\\x00\\x00\\xe0\\xb5\\xa0BF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3801 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3802 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\admin\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3803 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3804 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3805 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": false, "return": "0xffffffffc00000ba", "pretty_return": "FILE_IS_A_DIRECTORY", "arguments": [ { "name": "FileHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3806 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3807 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\xbf\\xaf!q\\x00\\x00\\x000\\xbf\\xaf!q\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\xf0\\x15\\xa1\\x93\\x80Y\\x00\\x00\\x08\\x82\\xdb\\x17\\xff\\x7f\\x00\\x00`\\xab\\x0eAF\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfak}W\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xbf\\xaf!q\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xab\\x0eAF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xbf\\xaf!q\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3808 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3809 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3810 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3811 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3812 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf6@F\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xb7\\x17\\xff\\x7f\\x00\\x00.\\xd0<\\xe7\\x01\\x00\\x00\\x00\\xfeY}W\\xff\\x7f\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x00`\\x1a\\xff\\x7f\\x00\\x00\\xe8\\xc2\\xaf!q\\x00\\x00\\x00`\\x11\\xb9\\x17\\xff\\x7f\\x00\\x00\\xcdG\\xf7Y\\xff\\x7f\\x00\\x00\\x08\\xae\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\xda\\x17\\xff\\x7f\\x00\\x00\\x8e\\xd3<\\xe7D\\xd1\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90EpEF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xb8\\x17\\xff\\x7f\\x00\\x00\\xe0\\xb5\\xa0BF\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3813 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3814 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Users\\" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3815 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x000900a8", "pretty_value": "FSCTL_GET_REPARSE_POINT" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "" } ], "repeated": 0, "id": 3816 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3817 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" } ], "repeated": 0, "id": 3818 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x004d0008", "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" } ], "repeated": 0, "id": 3819 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3820 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3821 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 3822 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005f4" }, { "name": "IoControlCode", "value": "0x006d0008", "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS" }, { "name": "InBuffer", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00" }, { "name": "OutBuffer", "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00" } ], "repeated": 0, "id": 3823 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 3824 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "C:\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3825 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3826 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3827 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3828 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 3829 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3830 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3831 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3832 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3833 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 3834 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3835 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f0" } ], "repeated": 0, "id": 3836 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3837 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3838 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xb09\\x0fAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3839 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3840 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 3841 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005fc" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "CFGMGR32.dll" } ], "repeated": 0, "id": 3842 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000005fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x0004e000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3843 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3844 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5779b000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3845 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3846 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3847 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3848 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57789000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3849 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57788000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3850 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3851 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57788000" }, { "name": "ModuleName", "value": "CFGMGR32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3852 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3853 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "6500", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\CFGMGR32" }, { "name": "DllBase", "value": "0x7fff57750000" } ], "repeated": 0, "id": 3854 }, { "timestamp": "2026-05-29 01:19:10,322", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 3855 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3856 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3857 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005ec" }, { "name": "ValueName", "value": "DontShowSuperHidden" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden" } ], "repeated": 0, "id": 3858 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005ec" } ], "repeated": 0, "id": 3859 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3860 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" }, { "name": "Handle", "value": "0x000005ec" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer" } ], "repeated": 0, "id": 3861 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\" } ], "repeated": 0, "id": 3862 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ShellState" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState" } ], "repeated": 0, "id": 3863 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff57755d32", "parentcaller": "0x7fff57763fdd", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000005fc" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "GENERIC_READ" }, { "name": "FileName", "value": "\\Device\\DeviceApi\\CMApi" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "0" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3864 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3865 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff57755d32", "parentcaller": "0x7fff57763fdd", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cfgmgr32" }, { "name": "BaseAddress", "value": "0x7fff57750000" }, { "name": "InitRoutine", "value": "0x7fff57763750" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 3866 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3867 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3868 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3869 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff57fc5921", "parentcaller": "0x7fff57751ed1", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x000005fc" }, { "name": "IoControlCode", "value": "0x00470807" }, { "name": "InBuffer", "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00" } ], "repeated": 0, "id": 3870 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "NoWebView" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView" } ], "repeated": 0, "id": 3871 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3872 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "4004", "caller": "0x7fff558aa151", "parentcaller": "0x7fff558927a5", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 3873 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3874 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3875 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ClassicShell" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell" } ], "repeated": 0, "id": 3876 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3877 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3878 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" } ], "repeated": 0, "id": 3879 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d43a6", "parentcaller": "0x7fff5588bfeb", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3880 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3881 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3882 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3883 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-100000000000}\\" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\" } ], "repeated": 0, "id": 3884 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3885 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3886 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff55875fb2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000604" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000600" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3887 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3888 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 3889 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" } ], "repeated": 0, "id": 3890 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5587601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3891 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5589286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3892 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling" } ], "repeated": 0, "id": 3893 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3894 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3895 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3896 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "repeated": 0, "id": 3897 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3898 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3899 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000604" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-300300000000}\\" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" } ], "repeated": 0, "id": 3900 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3901 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" } ], "repeated": 0, "id": 3902 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3903 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "HideFileExt" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" } ], "repeated": 0, "id": 3904 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff55875fb2", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000600" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000604" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 3905 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 3906 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff55875ffc", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "Milliseconds", "value": "1000" } ], "repeated": 0, "id": 3907 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "4004", "caller": "0x7fff558aa151", "parentcaller": "0x7fff558927a5", "category": "filesystem", "api": "GetVolumeNameForVolumeMountPointW", "status": true, "return": "0x00000001", "arguments": [ { "name": "VolumeMountPoint", "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000EDDC00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\" }, { "name": "VolumeName", "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 3908 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "DontPrettyPath" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath" } ], "repeated": 0, "id": 3909 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5587601a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3910 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff5589286f", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3911 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3912 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000604" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 3913 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfa7", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3914 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "MapNetDrvBtn" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn" } ], "repeated": 0, "id": 3915 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Data" }, { "name": "Data", "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data" } ], "repeated": 0, "id": 3916 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff558759ad", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3917 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "WebView" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView" } ], "repeated": 0, "id": 3918 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588f616", "parentcaller": "0x7fff5588bf43", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000001", "pretty_value": "HKEY_CURRENT_USER" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume" } ], "repeated": 0, "id": 3919 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bf7f", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" } ], "repeated": 0, "id": 3920 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 3921 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ShowSuperHidden" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" } ], "repeated": 0, "id": 3922 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5808b76b", "parentcaller": "0x7fff5808b5e2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" }, { "name": "ValueName", "value": "Generation" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation" } ], "repeated": 0, "id": 3923 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5588bfeb", "parentcaller": "0x7fff55875a2d", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3924 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3925 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "NoNetCrawling" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling" } ], "repeated": 0, "id": 3926 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3927 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "AutoCheckSelect" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect" } ], "repeated": 0, "id": 3928 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d591b", "parentcaller": "0x7fff577ef54e", "category": "device", "api": "NtDeviceIoControlFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "HandleName", "value": "\\Device\\MountPointManager" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InputBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutputBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3929 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3930 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3931 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00" } ], "repeated": 0, "id": 3932 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef6dd", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3933 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3934 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ShowStatusBar" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar" } ], "repeated": 0, "id": 3935 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3936 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3937 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587626d", "category": "device", "api": "DeviceIoControl", "status": false, "return": "0x00000000", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00" } ], "repeated": 0, "id": 3938 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef6dd", "parentcaller": "0x7fff5587626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3939 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3940 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff5781026b", "parentcaller": "0x7fff557c956d", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000604" } ], "repeated": 0, "id": 3941 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f0" } ], "repeated": 0, "id": 3942 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff557ca4ff", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`C\\x0fAF\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3943 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff557c9591", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3944 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 3945 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3946 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 3947 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587620d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3948 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3949 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000604" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\MountPointManager" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3950 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577ef54e", "parentcaller": "0x7fff5587626d", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000604" }, { "name": "IoControlCode", "value": "0x006d0034", "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS" }, { "name": "InBuffer", "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "OutBuffer", "value": "\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3951 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "6500", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577ef55e", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3952 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005f2" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 3953 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f2" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3954 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x00000606" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 3955 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000606" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3956 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x000005f6" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 3957 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f6" }, { "name": "SubKey", "value": "ShellEx\\IconHandler" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler" } ], "repeated": 0, "id": 3958 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f2" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 3959 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f2" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject" } ], "repeated": 0, "id": 3960 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000606" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 3961 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000606" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject" } ], "repeated": 0, "id": 3962 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f6" }, { "name": "ValueName", "value": "DocObject" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 3963 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f6" }, { "name": "SubKey", "value": "DocObject" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject" } ], "repeated": 0, "id": 3964 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f2" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 3965 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f2" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace" } ], "repeated": 0, "id": 3966 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000606" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 3967 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000606" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace" } ], "repeated": 0, "id": 3968 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f6" }, { "name": "ValueName", "value": "BrowseInPlace" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 3969 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f6" }, { "name": "SubKey", "value": "BrowseInPlace" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace" } ], "repeated": 0, "id": 3970 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f2" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid" } ], "repeated": 0, "id": 3971 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000606" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid" } ], "repeated": 0, "id": 3972 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f6" }, { "name": "SubKey", "value": "Clsid" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid" } ], "repeated": 0, "id": 3973 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f2" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut" } ], "repeated": 0, "id": 3974 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000606" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut" } ], "repeated": 0, "id": 3975 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f6" }, { "name": "ValueName", "value": "IsShortcut" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut" } ], "repeated": 0, "id": 3976 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f2" }, { "name": "ValueName", "value": "AlwaysShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt" } ], "repeated": 0, "id": 3977 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f2" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt" } ], "repeated": 0, "id": 3978 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000606" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt" } ], "repeated": 0, "id": 3979 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f6" }, { "name": "ValueName", "value": "NeverShowExt" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt" } ], "repeated": 0, "id": 3980 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f2" } ], "repeated": 0, "id": 3981 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000606" } ], "repeated": 0, "id": 3982 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f6" } ], "repeated": 0, "id": 3983 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3984 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e86000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3985 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f4" } ], "repeated": 0, "id": 3986 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3987 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 3988 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 3989 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000604" }, { "name": "SubKey", "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}" } ], "repeated": 0, "id": 3990 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 3991 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category" } ], "repeated": 0, "id": 3992 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name" } ], "repeated": 0, "id": 3993 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder" } ], "repeated": 0, "id": 3994 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description" } ], "repeated": 0, "id": 3995 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath" } ], "repeated": 0, "id": 3996 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName" } ], "repeated": 0, "id": 3997 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip" } ], "repeated": 0, "id": 3998 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName" } ], "repeated": 0, "id": 3999 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon" } ], "repeated": 0, "id": 4000 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security" } ], "repeated": 0, "id": 4001 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource" } ], "repeated": 0, "id": 4002 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType" } ], "repeated": 0, "id": 4003 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4004 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable" } ], "repeated": 0, "id": 4005 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate" } ], "repeated": 0, "id": 4006 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream" } ], "repeated": 0, "id": 4007 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath" } ], "repeated": 0, "id": 4008 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags" } ], "repeated": 0, "id": 4009 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes" } ], "repeated": 0, "id": 4010 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID" } ], "repeated": 0, "id": 4011 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler" } ], "repeated": 0, "id": 4012 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag" } ], "repeated": 0, "id": 4013 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4014 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4015 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4016 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4017 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x7f\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xf0\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4018 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005f0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4019 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4020 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4021 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" }, { "name": "ValueName", "value": "Start Menu" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu" } ], "repeated": 0, "id": 4022 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4023 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4024 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000604" } ], "repeated": 0, "id": 4025 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4026 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4027 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4028 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}" } ], "repeated": 0, "id": 4029 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4030 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "3" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category" } ], "repeated": 0, "id": 4031 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Common Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name" } ], "repeated": 0, "id": 4032 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder" } ], "repeated": 0, "id": 4033 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description" } ], "repeated": 0, "id": 4034 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath" } ], "repeated": 0, "id": 4035 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName" } ], "repeated": 0, "id": 4036 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip" } ], "repeated": 0, "id": 4037 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21786" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName" } ], "repeated": 0, "id": 4038 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon" } ], "repeated": 0, "id": 4039 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security" } ], "repeated": 0, "id": 4040 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource" } ], "repeated": 0, "id": 4041 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType" } ], "repeated": 0, "id": 4042 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4043 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable" } ], "repeated": 0, "id": 4044 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate" } ], "repeated": 0, "id": 4045 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream" } ], "repeated": 0, "id": 4046 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath" } ], "repeated": 0, "id": 4047 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags" } ], "repeated": 0, "id": 4048 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes" } ], "repeated": 0, "id": 4049 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID" } ], "repeated": 0, "id": 4050 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler" } ], "repeated": 0, "id": 4051 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag" } ], "repeated": 0, "id": 4052 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4053 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4054 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4055 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4056 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4057 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" }, { "name": "ValueName", "value": "Common Start Menu" }, { "name": "Data", "value": "%ProgramData%\\Microsoft\\Windows\\Start Menu" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu" } ], "repeated": 0, "id": 4058 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4059 }, { "timestamp": "2026-05-29 01:19:10,337", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4060 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f0" } ], "repeated": 0, "id": 4061 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4062 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4063 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4064 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000604" }, { "name": "SubKey", "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}" } ], "repeated": 0, "id": 4065 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4066 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category" } ], "repeated": 0, "id": 4067 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name" } ], "repeated": 0, "id": 4068 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder" } ], "repeated": 0, "id": 4069 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description" } ], "repeated": 0, "id": 4070 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath" } ], "repeated": 0, "id": 4071 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName" } ], "repeated": 0, "id": 4072 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "Data", "value": "@shell32,dll,-12692" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip" } ], "repeated": 0, "id": 4073 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\shell32.dll,-21797" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName" } ], "repeated": 0, "id": 4074 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-117" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon" } ], "repeated": 0, "id": 4075 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security" } ], "repeated": 0, "id": 4076 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource" } ], "repeated": 0, "id": 4077 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType" } ], "repeated": 0, "id": 4078 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4079 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable" } ], "repeated": 0, "id": 4080 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate" } ], "repeated": 0, "id": 4081 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream" } ], "repeated": 0, "id": 4082 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath" } ], "repeated": 0, "id": 4083 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags" } ], "repeated": 0, "id": 4084 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes" } ], "repeated": 0, "id": 4085 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID" } ], "repeated": 0, "id": 4086 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler" } ], "repeated": 0, "id": 4087 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag" } ], "repeated": 0, "id": 4088 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4089 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4090 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4091 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4092 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x7f\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xf4\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4093 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005f4" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4094 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4095 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4096 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" }, { "name": "ValueName", "value": "Recent" }, { "name": "Data", "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent" } ], "repeated": 0, "id": 4097 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4098 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4099 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000604" } ], "repeated": 0, "id": 4100 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4101 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4102 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4103 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f0" }, { "name": "SubKey", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } ], "repeated": 0, "id": 4104 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f0" } ], "repeated": 0, "id": 4105 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category" } ], "repeated": 0, "id": 4106 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Windows" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name" } ], "repeated": 0, "id": 4107 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder" } ], "repeated": 0, "id": 4108 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description" } ], "repeated": 0, "id": 4109 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath" } ], "repeated": 0, "id": 4110 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName" } ], "repeated": 0, "id": 4111 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip" } ], "repeated": 0, "id": 4112 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName" } ], "repeated": 0, "id": 4113 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon" } ], "repeated": 0, "id": 4114 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security" } ], "repeated": 0, "id": 4115 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource" } ], "repeated": 0, "id": 4116 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType" } ], "repeated": 0, "id": 4117 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4118 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable" } ], "repeated": 0, "id": 4119 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate" } ], "repeated": 0, "id": 4120 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream" } ], "repeated": 0, "id": 4121 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath" } ], "repeated": 0, "id": 4122 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags" } ], "repeated": 0, "id": 4123 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes" } ], "repeated": 0, "id": 4124 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID" } ], "repeated": 0, "id": 4125 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f4" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler" } ], "repeated": 0, "id": 4126 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005f0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag" } ], "repeated": 0, "id": 4127 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4128 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4129 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000604" } ], "repeated": 0, "id": 4130 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4131 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4132 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4133 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f4" }, { "name": "SubKey", "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" }, { "name": "Handle", "value": "0x000005f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}" } ], "repeated": 0, "id": 4134 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f4" } ], "repeated": 0, "id": 4135 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category" } ], "repeated": 0, "id": 4136 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "System" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name" } ], "repeated": 0, "id": 4137 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder" } ], "repeated": 0, "id": 4138 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description" } ], "repeated": 0, "id": 4139 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath" } ], "repeated": 0, "id": 4140 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName" } ], "repeated": 0, "id": 4141 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip" } ], "repeated": 0, "id": 4142 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName" } ], "repeated": 0, "id": 4143 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon" } ], "repeated": 0, "id": 4144 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security" } ], "repeated": 0, "id": 4145 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource" } ], "repeated": 0, "id": 4146 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType" } ], "repeated": 0, "id": 4147 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4148 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable" } ], "repeated": 0, "id": 4149 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate" } ], "repeated": 0, "id": 4150 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream" } ], "repeated": 0, "id": 4151 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4152 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags" } ], "repeated": 0, "id": 4153 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes" } ], "repeated": 0, "id": 4154 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID" } ], "repeated": 0, "id": 4155 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler" } ], "repeated": 0, "id": 4156 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f8" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x000005f4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag" } ], "repeated": 0, "id": 4157 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4158 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4159 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000604" } ], "repeated": 0, "id": 4160 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4161 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4162 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x000005f8" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4163 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005f8" }, { "name": "SubKey", "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}" } ], "repeated": 0, "id": 4164 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4165 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category" } ], "repeated": 0, "id": 4166 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Personal" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name" } ], "repeated": 0, "id": 4167 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder" } ], "repeated": 0, "id": 4168 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description" } ], "repeated": 0, "id": 4169 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "Data", "value": "Documents" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath" } ], "repeated": 0, "id": 4170 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "Data", "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName" } ], "repeated": 0, "id": 4171 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip" } ], "repeated": 0, "id": 4172 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "Data", "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName" } ], "repeated": 0, "id": 4173 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Icon" }, { "name": "Data", "value": "%SystemRoot%\\system32\\imageres.dll,-112" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon" } ], "repeated": 0, "id": 4174 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security" } ], "repeated": 0, "id": 4175 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource" } ], "repeated": 0, "id": 4176 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType" } ], "repeated": 0, "id": 4177 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4178 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Roamable" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable" } ], "repeated": 0, "id": 4179 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate" } ], "repeated": 0, "id": 4180 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream" } ], "repeated": 0, "id": 4181 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath" } ], "repeated": 0, "id": 4182 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags" } ], "repeated": 0, "id": 4183 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Attributes" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes" } ], "repeated": 0, "id": 4184 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID" } ], "repeated": 0, "id": 4185 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler" } ], "repeated": 0, "id": 4186 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000608" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag" } ], "repeated": 0, "id": 4187 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4188 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000005ec" }, { "name": "SubKey", "value": "SessionInfo\\1" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1" } ], "repeated": 0, "id": 4189 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "KnownFolders" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders" } ], "repeated": 0, "id": 4190 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4191 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x7f\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4192 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000600" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER" } ], "repeated": 0, "id": 4193 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" }, { "name": "Handle", "value": "0x0000060c" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders" } ], "repeated": 0, "id": 4194 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4195 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" }, { "name": "ValueName", "value": "Personal" }, { "name": "Data", "value": "%USERPROFILE%\\Documents" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal" } ], "repeated": 0, "id": 4196 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4197 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4198 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000060c" } ], "repeated": 0, "id": 4199 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4200 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\x83\\xaf!q\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4201 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions" } ], "repeated": 0, "id": 4202 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000604" }, { "name": "SubKey", "value": "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}" } ], "repeated": 0, "id": 4203 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000604" } ], "repeated": 0, "id": 4204 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Category" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category" } ], "repeated": 0, "id": 4205 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Name" }, { "name": "Data", "value": "Fonts" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name" } ], "repeated": 0, "id": 4206 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "ParentFolder" }, { "name": "Data", "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder" } ], "repeated": 0, "id": 4207 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Description" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description" } ], "repeated": 0, "id": 4208 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "RelativePath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath" } ], "repeated": 0, "id": 4209 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "ParsingName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName" } ], "repeated": 0, "id": 4210 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "InfoTip" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip" } ], "repeated": 0, "id": 4211 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "LocalizedName" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName" } ], "repeated": 0, "id": 4212 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Icon" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon" } ], "repeated": 0, "id": 4213 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Security" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security" } ], "repeated": 0, "id": 4214 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "StreamResource" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource" } ], "repeated": 0, "id": 4215 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "StreamResourceType" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType" } ], "repeated": 0, "id": 4216 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "LocalRedirectOnly" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly" } ], "repeated": 0, "id": 4217 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Roamable" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable" } ], "repeated": 0, "id": 4218 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "PreCreate" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate" } ], "repeated": 0, "id": 4219 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Stream" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream" } ], "repeated": 0, "id": 4220 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "PublishExpandedPath" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath" } ], "repeated": 0, "id": 4221 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "DefinitionFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags" } ], "repeated": 0, "id": 4222 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "Attributes" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes" } ], "repeated": 0, "id": 4223 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "FolderTypeID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID" } ], "repeated": 0, "id": 4224 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "ValueName", "value": "InitFolderHandler" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler" } ], "repeated": 0, "id": 4225 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000600" }, { "name": "SubKey", "value": "PropertyBag" }, { "name": "Handle", "value": "0x00000604" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag" } ], "repeated": 0, "id": 4226 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4227 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4228 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4229 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4230 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55e85000" }, { "name": "ModuleName", "value": "windows.storage.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4231 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "MutexName", "value": "Local\\SM0:8972:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 4232 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4233 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4234 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4235 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4236 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4237 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4238 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4239 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4240 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4241 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000005f8" } ], "repeated": 0, "id": 4242 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "18" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4243 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "20" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00" } ], "repeated": 0, "id": 4244 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4245 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Directory" }, { "name": "Handle", "value": "0x000005fa" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Directory" } ], "repeated": 0, "id": 4246 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005fa" }, { "name": "KeyInformation", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4247 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000005fa" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 1, "id": 4248 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000005fa" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4249 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4250 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Folder" }, { "name": "Handle", "value": "0x0000060e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Folder" } ], "repeated": 0, "id": 4251 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4252 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4253 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb3\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x0e\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00P\\xb4\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 4254 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4255 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4256 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000060e" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4257 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "AllFilesystemObjects" }, { "name": "Handle", "value": "0x00000602" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects" } ], "repeated": 0, "id": 4258 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000602" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 4259 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000602" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4260 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "P\\xb3\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\x02\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00q\\x00\\x00\\x00P\\xb4\\xaf!q\\x00\\x00\\x00" } ], "repeated": 0, "id": 4261 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4262 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000602" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 4263 }, { "timestamp": "2026-05-29 01:19:10,353", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000602" }, { "name": "ObjectAttributesName", "value": "ShellEx\\PropertyHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler" } ], "repeated": 0, "id": 4264 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005fa" } ], "repeated": 0, "id": 4265 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060e" } ], "repeated": 0, "id": 4266 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000602" } ], "repeated": 0, "id": 4267 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x00000600" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 4268 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000600" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4269 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000600" } ], "repeated": 0, "id": 4270 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645708000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4271 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions" }, { "name": "Handle", "value": "0x00000602" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions" } ], "repeated": 0, "id": 4272 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegEnumKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000602" }, { "name": "Index", "value": "0" }, { "name": "Name", "value": "{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 4273 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" }, { "name": "Handle", "value": "0x0000060e" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}" } ], "repeated": 0, "id": 4274 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060e" }, { "name": "ValueName", "value": "DriveMask" }, { "name": "Data", "value": "32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask" } ], "repeated": 0, "id": 4275 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060e" } ], "repeated": 0, "id": 4276 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegEnumKeyExW", "status": false, "return": "0x00000103", "pretty_return": "NO_MORE_ITEMS", "arguments": [ { "name": "Handle", "value": "0x00000602" }, { "name": "Index", "value": "1" }, { "name": "Name", "value": "" }, { "name": "Class", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\" } ], "repeated": 0, "id": 4277 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000602" } ], "repeated": 0, "id": 4278 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410f8000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4279 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000060c" } ], "repeated": 0, "id": 4280 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 4281 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4282 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4283 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000323-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000146-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4284 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" }, { "name": "Handle", "value": "0x0000060c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager" } ], "repeated": 0, "id": 4285 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryInfoKeyW", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "Class", "value": "" }, { "name": "SubKeyCount", "value": "0" }, { "name": "MaxSubKeyLength", "value": "0" }, { "name": "MaxClassLength", "value": "0" }, { "name": "ValueCount", "value": "0" }, { "name": "MaxValueNameLength", "value": "0" }, { "name": "MaxValueLength", "value": "0" } ], "repeated": 0, "id": 4286 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4287 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\windows.storage.dll" }, { "name": "BaseAddress", "value": "0x7fff55710000" } ], "repeated": 0, "id": 4288 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstanceEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "ServerName", "value": "" }, { "name": "ProgID", "value": "" } ], "repeated": 1, "id": 4289 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "FindFirstFileExW", "status": false, "return": "0xffffffffffffffff", "arguments": [ { "name": "FileName", "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*" } ], "repeated": 0, "id": 4290 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 1, "id": 4291 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4292 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6D5140C1-7436-11CE-8034-00AA006009FA" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4293 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4294 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4295 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4296 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4297 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4298 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90`\\x0fAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000a\\x0fAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pa\\x0fAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00db\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00xb\\x0fAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0b\\x0fAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8b\\x0fAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80a\\x0fAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06b\\x0fAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0cb\\x0fAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 4299 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 4300 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4301 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4302 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4303 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "6500", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246410fe000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4304 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4305 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4306 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4307 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4308 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4309 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "99B29D3B-368A-4BE6-B675-805A69114497" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4310 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4311 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4312 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4313 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4314 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4315 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4316 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4317 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4318 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4319 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4320 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4321 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4322 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4323 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4324 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4325 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4326 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4327 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4328 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000564" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4329 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4330 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000548" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4331 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4332 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x84pEF\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00" } ], "repeated": 0, "id": 4333 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4334 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4335 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4336 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4337 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4338 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4339 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4340 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4341 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4342 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4343 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4344 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4345 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4346 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" }, { "name": "Handle", "value": "0x0000060c" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces" } ], "repeated": 0, "id": 4347 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" }, { "name": "ValueName", "value": "DefaultStart" }, { "name": "Data", "value": "Windows.Internal.ApplicationModel.StartPinnableSurface" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart" } ], "repeated": 0, "id": 4348 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4349 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000060c" }, { "name": "DesiredAccess", "value": "0x00000004" }, { "name": "ObjectAttributes", "value": "ApplicationService:230c1dcef09253fc167" } ], "repeated": 0, "id": 4350 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x0000060c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645ff0000" }, { "name": "SectionOffset", "value": "0x7121afcec0" }, { "name": "ViewSize", "value": "0x00010000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4351 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4352 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570d000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4353 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645ff0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4354 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4355 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570c000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4356 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x0000000a" }, { "name": "TokenHandle", "value": "0x0000060c" } ], "repeated": 0, "id": 4357 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4358 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "DesiredAccess", "value": "0x80000000", "pretty_value": "0x80000000" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities" } ], "repeated": 0, "id": 4359 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000060c" }, { "name": "ValueName", "value": "shellExperience" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience" } ], "repeated": 0, "id": 4360 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xcc\\xaf!q\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 4361 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000060c" } ], "repeated": 0, "id": 4362 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000005f8" } ], "repeated": 0, "id": 4363 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00d\\x1cc\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4364 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640010b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4365 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4366 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4367 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4368 }, { "timestamp": "2026-05-29 01:19:10,369", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4369 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4370 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4371 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4372 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000558" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4373 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400056000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4374 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x9f\\xca\\x8c\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4375 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4376 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "5000" } ], "repeated": 0, "id": 4377 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x001\\x2cc\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4378 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb0\\xcb\\x8c\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4379 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 7, "id": 4380 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d08ee", "parentcaller": "0x7fff58568bd7", "category": "process", "api": "NtOpenProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000053c" }, { "name": "DesiredAccess", "value": "0x00001000", "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION" }, { "name": "ProcessIdentifier", "value": "8972" } ], "repeated": 0, "id": 4381 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000053c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000610" } ], "repeated": 0, "id": 4382 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4383 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90`\\x0fAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000a\\x0fAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pa\\x0fAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00db\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00xb\\x0fAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0b\\x0fAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8b\\x0fAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80a\\x0fAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06b\\x0fAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0cb\\x0fAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 4384 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 0, "id": 4385 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000053c" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000610" } ], "repeated": 0, "id": 4386 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 4387 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x90`\\x0fAF\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x000a\\x0fAF\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pa\\x0fAF\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00db\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00xb\\x0fAF\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x80b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0b\\x0fAF\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xa8b\\x0fAF\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8b\\x0fAF\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x80a\\x0fAF\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x06b\\x0fAF\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x0cb\\x0fAF\\x02\\x00\\x00" } ], "repeated": 0, "id": 4388 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 0, "id": 4389 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000053c" } ], "repeated": 0, "id": 4390 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4391 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4392 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4393 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4394 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff584c6d2f", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000053c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 4395 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4396 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 0, "id": 4397 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff58085b05", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x9a!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\x1c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "7352" } ], "repeated": 0, "id": 4398 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4399 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "4998" } ], "repeated": 0, "id": 4400 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff580b84de", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 4401 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4402 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4403 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4404 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4405 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 4406 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570c000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4407 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff59f72caa", "parentcaller": "0x7fff59f72fbd", "category": "process", "api": "NtAllocateVirtualMemoryEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2464570d000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4408 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "3272", "caller": "0x7fff5780ebae", "parentcaller": "0x7fff5808712f", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x0c\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "3272" } ], "repeated": 0, "id": 4409 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "7352", "caller": "0x7fff577d6785", "parentcaller": "0x7fff58542ec5", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000610" } ], "repeated": 1, "id": 4410 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xcd\\xe7\\x8c\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4411 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4412 }, { "timestamp": "2026-05-29 01:19:10,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "4993" } ], "repeated": 0, "id": 4413 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400144000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4414 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf4;\\xd9\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4415 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4416 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "611" } ], "repeated": 0, "id": 4417 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00g<\\xd9\\x0b\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "128" } ], "repeated": 0, "id": 4418 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4419 }, { "timestamp": "2026-05-29 01:19:15,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "611" } ], "repeated": 0, "id": 4420 }, { "timestamp": "2026-05-29 01:19:16,009", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400148000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4421 }, { "timestamp": "2026-05-29 01:19:16,009", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f640012c000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4422 }, { "timestamp": "2026-05-29 01:19:16,009", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400148000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 4423 }, { "timestamp": "2026-05-29 01:19:16,009", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4424 }, { "timestamp": "2026-05-29 01:19:16,009", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "4378" } ], "repeated": 0, "id": 4425 }, { "timestamp": "2026-05-29 01:19:17,994", "thread_id": "1304", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820ee58", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4426 }, { "timestamp": "2026-05-29 01:19:17,994", "thread_id": "1304", "caller": "0x7fff577c30ce", "parentcaller": "0x2464820ee58", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" }, { "name": "Milliseconds", "value": "10000" } ], "repeated": 0, "id": 4427 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00T\\x8c%\\x0c\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "112" } ], "repeated": 0, "id": 4428 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "6780", "caller": "0x7fff577f4448", "parentcaller": "0x246472ff766", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2f6400071000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4429 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "11621" } ], "repeated": 0, "id": 4430 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "6780", "caller": "0x7fff577d5810", "parentcaller": "0x246480cf3bb", "category": "filesystem", "api": "NtReadFile", "status": true, "return": "0x00000103", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x13\\x8e%\\x0c\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4431 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5294f000" }, { "name": "ModuleName", "value": "PROPSYS.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4432 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 4433 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4434 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" }, { "name": "Milliseconds", "value": "11618" } ], "repeated": 0, "id": 4435 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "6780", "caller": "0x7fff577d53aa", "parentcaller": "0x24647ca0093", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xba\\xa1%\\x0c\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4436 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "6780", "caller": "0x7fff577d53aa", "parentcaller": "0x246480cf4b5", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x10\\xa4%\\x0c\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4437 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "filesystem", "api": "NtWriteFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001728" }, { "name": "HandleName", "value": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" }, { "name": "Buffer", "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x564%\\x0c\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "Length", "value": "64" } ], "repeated": 0, "id": 4438 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 4439 }, { "timestamp": "2026-05-29 01:19:20,384", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 4440 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000328" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00|\\x1a\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6780" } ], "repeated": 0, "id": 4441 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4442 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6780", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 4443 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6780", "caller": "0x7fff5780ebae", "parentcaller": "0x246482c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00|\\x1a\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6780" } ], "repeated": 0, "id": 4444 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6780", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 4445 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6780", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6780" } ], "repeated": 0, "id": 4446 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6780", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4447 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 4448 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 4449 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 4450 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x000002f8" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6020" } ], "repeated": 0, "id": 4451 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6020", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000030c" } ], "repeated": 0, "id": 4452 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6020", "caller": "0x7fff5780ebae", "parentcaller": "0x246482c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x99!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x17\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6020" } ], "repeated": 0, "id": 4453 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6020", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 4454 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6020", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "6020" } ], "repeated": 0, "id": 4455 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "6020", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4456 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 4457 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 4458 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 4459 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 4460 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 4461 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645c20000" }, { "name": "RegionSize", "value": "0x000d6000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4462 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a8" } ], "repeated": 0, "id": 4463 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a4" } ], "repeated": 0, "id": 4464 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x2465b2b0000" }, { "name": "RegionSize", "value": "0x021d5000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4465 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 4466 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 4467 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x24645a30000" }, { "name": "RegionSize", "value": "0x001e6000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4468 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002a0" } ], "repeated": 0, "id": 4469 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000029c" } ], "repeated": 0, "id": 4470 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x246458f0000" }, { "name": "RegionSize", "value": "0x0013b000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 4471 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 4472 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 4473 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ADVAPI32.dll" }, { "name": "ModuleHandle", "value": "0x7fff599c0000" }, { "name": "FunctionName", "value": "UnregisterTraceGuids" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fa0340" } ], "repeated": 0, "id": 4474 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 4475 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000258" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x98!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x06\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1772" } ], "repeated": 0, "id": 4476 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "1772", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 4477 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 4478 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "1772", "caller": "0x7fff5780ebae", "parentcaller": "0x246482c9d18", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "0", "pretty_value": "ThreadBasicInformation" }, { "name": "ThreadInformation", "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x98!q\\x00\\x00\\x00\\x0c#\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x06\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1772" } ], "repeated": 0, "id": 4479 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "1772", "caller": "0x7ff7da574c88", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 4480 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "1772", "caller": "0x7fff59fa467e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtQueryInformationThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0xfffffffe" }, { "name": "ThreadInformationClass", "value": "12" }, { "name": "ThreadInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "ThreadId", "value": "1772" } ], "repeated": 0, "id": 4481 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "1772", "caller": "0x7fff59fa469e", "parentcaller": "0x7fff57fc734d", "category": "threading", "api": "NtTerminateThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000000" }, { "name": "ExitStatus", "value": "0x00000000" }, { "name": "ThreadId", "value": "0" }, { "name": "ProcessId", "value": "0" } ], "repeated": 0, "id": 4482 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b649", "parentcaller": "0x7ff7da614f22", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000258" } ], "repeated": 0, "id": 4483 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 4484 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001fc" } ], "repeated": 0, "id": 4485 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da574c88", "parentcaller": "0x7ff7da55b649", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024c" } ], "repeated": 0, "id": 4486 }, { "timestamp": "2026-05-29 01:19:20,400", "thread_id": "8608", "caller": "0x7ff7da55b65c", "parentcaller": "0x7ff7da614f22", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 4487 } ], "threads": [ "8608", "8828", "8796", "8808", "672", "3980", "1772", "1360", "1304", "6020", "6016", "9072", "6780", "3272", "9144", "8072", "9148", "820", "8784", "4004", "7352", "6500" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7da540000", "MainExeSize": "0x0028c000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 832, "process_name": "svchost.exe", "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "first_seen": "2026-05-29 01:19:08,109", "calls": [ { "timestamp": "2026-05-29 01:19:09,578", "thread_id": "1640", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001684" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "780", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "780", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "780", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000fb4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001588" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000d0c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000d0c" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001588" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:19:17,546", "thread_id": "1064", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001510" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000fb4" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000818" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000818" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001028" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000818" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000810" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001488" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015fc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000015fc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001488" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001684" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000ce4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000810" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000810" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000818" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000810" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000810" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000818" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000818" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000810" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "3476", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015b8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:19:17,562", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x000016d0" }, { "name": "ThreadHandle", "value": "0x00000e60" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193396536" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:19:17,578", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "8504" }, { "name": "ThreadId", "value": "7064" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x000016d0" }, { "name": "ThreadHandle", "value": "0x00000e60" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "780", "caller": "0x7fff555f3391", "parentcaller": "0x7fff555b1704", "category": "threading", "api": "NtResumeThread", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x00000e60" }, { "name": "SuspendCount", "value": "1" }, { "name": "ThreadId", "value": "7064" }, { "name": "ProcessId", "value": "8504" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000818" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016dc" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016d8" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016d8" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000016dc" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "9164", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:19:17,593", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001630" }, { "name": "ThreadHandle", "value": "0x00000b20" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193390108" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\system32\\backgroundTaskHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2076" }, { "name": "ThreadId", "value": "2560" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x00001630" }, { "name": "ThreadHandle", "value": "0x00000b20" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "1652", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00001510" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000b34" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "780", "caller": "0x7fff59f9bb2a", "parentcaller": "0x7fff59f9b99e", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000016c8" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "780", "caller": "0x7fff59f9bbcc", "parentcaller": "0x7fff59f9b99e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000006ec" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f5600000" }, { "name": "SectionOffset", "value": "0xcca6d7b370" }, { "name": "ViewSize", "value": "0x00140000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "780", "caller": "0x7fff5567f3ed", "parentcaller": "0x7fff555b18f8", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00001630" }, { "name": "ExitCode", "value": "0x80070bf7" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "780", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001630" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0xcca6d7e720" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5851aff0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000352-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001028" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001630" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001630" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000080", "pretty_value": "FILE_ATTRIBUTE_NORMAL" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577b3d8e", "parentcaller": "0x7fff577b3354", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00001028" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00001000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:19:17,625", "thread_id": "9132", "caller": "0x7fff577b3395", "parentcaller": "0x7fff577b3f0a", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:19:19,578", "thread_id": "928", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000b34" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:19:26,343", "thread_id": "780", "caller": "0x7fff573374d2", "parentcaller": "0x7fff5733739e", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xffffffff" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e0" }, { "name": "Options", "value": "0x00000000" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:19:29,562", "thread_id": "928", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000007dc" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:19:39,578", "thread_id": "780", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x000008b4" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:19:49,562", "thread_id": "780", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001578" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:19:59,578", "thread_id": "1652", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00001540" }, { "name": "DesiredAccess", "value": "0x00100080", "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "\\??\\PhysicalDrive0" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "3", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:19:59,687", "thread_id": "3408", "caller": "0x7fff59f95f9c", "parentcaller": "0x7fff59f95bbb", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 33, "id": 103 }, { "timestamp": "2026-05-29 01:20:01,296", "thread_id": "780", "caller": "0x7fff577d6579", "parentcaller": "0x7fff577d5fe6", "category": "filesystem", "api": "NtCreateFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000644" }, { "name": "DesiredAccess", "value": "0x80100080", "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthHost.exe" }, { "name": "CreateDisposition", "value": "1", "pretty_value": "FILE_OPEN" }, { "name": "ShareAccess", "value": "1", "pretty_value": "FILE_SHARE_READ" }, { "name": "FileAttributes", "value": "0x00000000" }, { "name": "ExistedBefore", "value": "yes" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:20:01,296", "thread_id": "780", "caller": "0x7fff5780c386", "parentcaller": "0x7fff5780c25e", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x000015c4" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x256f3790000" }, { "name": "SectionOffset", "value": "0xcca6d7d9e0" }, { "name": "ViewSize", "value": "0x00019000" }, { "name": "Win32Protect", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:20:01,296", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015c0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:20:01,296", "thread_id": "780", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000168c" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\System32\\SecurityHealthHost.exe" }, { "name": "CommandLine", "value": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding" }, { "name": "DllPath", "value": "" }, { "name": "ProcessId", "value": "140733193393264" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:20:01,312", "thread_id": "780", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "" }, { "name": "CommandLine", "value": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding" }, { "name": "CreationFlags", "value": "0x00000410", "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT" }, { "name": "ProcessId", "value": "5232" }, { "name": "ThreadId", "value": "6740" }, { "name": "ProcessHandle", "value": "0x0000168c" }, { "name": "ThreadHandle", "value": "0x000015c4" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:20:01,406", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001610" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:20:01,453", "thread_id": "780", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x0000168c" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:20:01,500", "thread_id": "780", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000008b4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000006e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:20:01,500", "thread_id": "780", "caller": "0x7fff555422bd", "parentcaller": "0x7fff5544ce49", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x000008b4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000810" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:20:01,500", "thread_id": "780", "caller": "0x7fff55447024", "parentcaller": "0x7fff55447125", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000810" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001488" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:20:01,500", "thread_id": "1064", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000015e0" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:20:01,500", "thread_id": "1064", "caller": "0x7fff577fc5f2", "parentcaller": "0x7fff577f89f3", "category": "process", "api": "NtCreateUserProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x0000160c" }, { "name": "ThreadHandle", "value": "0x000016a0" }, { "name": "ProcessDesiredAccess", "value": "0x02000000" }, { "name": "ThreadDesiredAccess", "value": "0x02000000" }, { "name": "ProcessFileName", "value": "" }, { "name": "ThreadName", "value": "" }, { "name": "ImagePathName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca" }, { "name": "DllPath", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy;" }, { "name": "ProcessId", "value": "140733193390468" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:20:01,843", "thread_id": "464", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff555d1c70", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0x00000eb4" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00001608" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:20:02,218", "thread_id": "1064", "caller": "0x7fff577f89f3", "parentcaller": "0x7fff57fcde30", "category": "process", "api": "CreateProcessInternalW", "status": true, "return": "0x00000001", "arguments": [ { "name": "ApplicationName", "value": "C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe" }, { "name": "CommandLine", "value": "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca" }, { "name": "CreationFlags", "value": "0x00080414", "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT" }, { "name": "ProcessId", "value": "2436" }, { "name": "ThreadId", "value": "5812" }, { "name": "ParentHandle", "value": "0xffffffff" }, { "name": "ProcessHandle", "value": "0x0000160c" }, { "name": "ThreadHandle", "value": "0x000016a0" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 117 } ], "threads": [ "1640", "780", "3476", "1064", "9164", "1652", "9132", "928", "3408", "464" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } }, { "process_id": 5232, "process_name": "SecurityHealthHost.exe", "parent_id": 832, "module_path": "C:\\Windows\\System32\\SecurityHealthHost.exe", "first_seen": "2026-05-29 01:20:01,324", "calls": [ { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 0 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6760", "caller": "0x7fff59faeb32", "parentcaller": "0x7fff59f677c3", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 1, "id": 1 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d3b2", "parentcaller": "0x7ff71c07d480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25592a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 2 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d3b2", "parentcaller": "0x7ff71c07d480", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25592b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 3 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d9a9", "parentcaller": "0x7ff71c07d480", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "api-ms-win-core-synch-l1-2-0.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" } ], "repeated": 0, "id": 4 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d9dc", "parentcaller": "0x7ff71c07d480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "InitializeConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb9f40" } ], "repeated": 0, "id": 5 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d9f0", "parentcaller": "0x7ff71c07d480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "SleepConditionVariableCS" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff57813890" } ], "repeated": 0, "id": 6 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07da04", "parentcaller": "0x7ff71c07d480", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "KERNELBASE.dll" }, { "name": "ModuleHandle", "value": "0x7fff577a0000" }, { "name": "FunctionName", "value": "WakeAllConditionVariable" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fa5430" } ], "repeated": 0, "id": 7 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07d409", "parentcaller": "0x7ff71c07d4a1", "category": "hooking", "api": "SetUnhandledExceptionFilter", "status": true, "return": "0x00000001", "arguments": [ { "name": "ExceptionFilter", "value": "0x7ff71c07dfe0" } ], "repeated": 0, "id": 8 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6692", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 9 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6692", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd2030" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 10 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07b3de", "parentcaller": "0x7ff71c07b36f", "category": "filesystem", "api": "NtQueryAttributesFile", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\MsMpLics.dll" } ], "repeated": 0, "id": 11 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c078a32", "parentcaller": "0x7ff71c075a8c", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "MutexName", "value": "Local\\SM0:5232:120:WilError_03" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 12 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c078a60", "parentcaller": "0x7ff71c075a8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 13 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c074b8d", "parentcaller": "0x7ff71c078b97", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 14 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c074baa", "parentcaller": "0x7ff71c078b97", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 15 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07523f", "parentcaller": "0x7ff71c078b07", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 16 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "7024", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 17 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "7024", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1a00" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 18 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c0736b5", "parentcaller": "0x7ff71c0738f4", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 19 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x00000000" } ], "repeated": 0, "id": 20 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6760", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 21 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "0", "pretty_value": "FILE_SUPERSEDE" } ], "repeated": 0, "id": 22 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6760", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1ed0" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 23 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000038" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 24 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "8424", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 25 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "8424", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff17bd1e10" }, { "name": "Parameter", "value": "0x00000000" } ], "repeated": 0, "id": 26 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 27 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "kernel.appcore.dll" } ], "repeated": 0, "id": 28 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 29 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x0000022c" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 30 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x0000022c" }, { "name": "FileName", "value": "C:\\Windows\\System32\\kernel.appcore.dll" } ], "repeated": 0, "id": 31 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00012000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 32 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5551f000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 33 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 34 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 35 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 36 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 37 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 38 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 39 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 40 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55515000" }, { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 41 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\kernel.appcore" }, { "name": "DllBase", "value": "0x7fff55510000" } ], "repeated": 0, "id": 42 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore" }, { "name": "BaseAddress", "value": "0x7fff55510000" }, { "name": "InitRoutine", "value": "0x7fff55513f10" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 43 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 44 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 45 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 46 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtOpenSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "bcryptPrimitives.dll" } ], "repeated": 0, "id": 47 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000230" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00082000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 48 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 49 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 50 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 51 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 52 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 53 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 54 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff57f57000" }, { "name": "ModuleName", "value": "bcryptPrimitives.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 55 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\bcryptPrimitives" }, { "name": "DllBase", "value": "0x7fff57ef0000" } ], "repeated": 0, "id": 56 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 57 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "STE" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE" } ], "repeated": 0, "id": 58 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 59 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 60 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtQueryValueKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "Enabled" }, { "name": "Type", "value": "4", "pretty_value": "REG_DWORD" }, { "name": "Information", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled" } ], "repeated": 0, "id": 61 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa" } ], "repeated": 0, "id": 62 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000240" }, { "name": "ValueName", "value": "FipsAlgorithmPolicy" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy" } ], "repeated": 0, "id": 63 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x0000023c" }, { "name": "ValueName", "value": "MDMEnabled" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled" } ], "repeated": 0, "id": 64 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 65 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 66 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "registry", "api": "NtOpenKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration" } ], "repeated": 0, "id": 67 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000240" }, { "name": "DesiredAccess", "value": "0x00100001", "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE" }, { "name": "FileName", "value": "\\Device\\CNG" }, { "name": "ShareAccess", "value": "7", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 68 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "device", "api": "DeviceIoControl", "status": true, "return": "0x00000001", "arguments": [ { "name": "DeviceHandle", "value": "0x00000240" }, { "name": "IoControlCode", "value": "0x00390008", "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER" }, { "name": "InBuffer", "value": "" }, { "name": "OutBuffer", "value": "s\\xd9\\xfbWs\\xb8p\\x15\\xb8\\x08\\xe1\\x96\\xbc\\xfc4\\xcb,\\x16\\x8b\\x1a\\xffae\\xa5eu0\\xff\\xfce\\x99~\\xad\\xc9\\xf7\\xea\\xfd\\xb1t `\\xd8\\xf4H\\xdc\\x1d\\xa4\\x94" } ], "repeated": 0, "id": 69 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives" }, { "name": "BaseAddress", "value": "0x7fff57ef0000" }, { "name": "InitRoutine", "value": "0x7fff57f28b60" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 70 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 71 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 72 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07c5d0", "parentcaller": "0x7ff71c0716da", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255931000" }, { "name": "RegionSize", "value": "0x00006000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 73 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071747", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\clbcatq" }, { "name": "DllBase", "value": "0x7fff58b30000" } ], "repeated": 0, "id": 74 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071747", "parentcaller": "0x7ff71c071c99", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000034B-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "0000015B-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 75 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07b835", "parentcaller": "0x7ff71c0714db", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000000", "pretty_value": "HKEY_CLASSES_ROOT" }, { "name": "SubKey", "value": "CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "Handle", "value": "0x00000276" }, { "name": "FullName", "value": "HKEY_CLASSES_ROOT\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" } ], "repeated": 0, "id": 76 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c07bb5f", "parentcaller": "0x7ff71c07bc9c", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" }, { "name": "ValueName", "value": "AppID" }, { "name": "Data", "value": "{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID" } ], "repeated": 0, "id": 77 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c0715fd", "parentcaller": "0x7ff71c0717e7", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000276" } ], "repeated": 0, "id": 78 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 79 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 80 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 81 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 82 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 83 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 84 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 85 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "164" } ], "repeated": 0, "id": 86 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx" } ], "repeated": 0, "id": 87 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 88 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 89 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock" } ], "repeated": 0, "id": 90 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000254" }, { "name": "ValueName", "value": "AllowDevelopmentWithoutDevLicense" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense" } ], "repeated": 0, "id": 91 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 92 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 93 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 94 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 95 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 96 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 97 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 98 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255937000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 99 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000254" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 100 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000254" }, { "name": "ValueName", "value": "RaiseActivationAuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel" } ], "repeated": 0, "id": 101 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000254" } ], "repeated": 0, "id": 102 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" }, { "name": "Handle", "value": "0x00000256" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" } ], "repeated": 0, "id": 103 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000256" }, { "name": "ValueName", "value": "AuthenticationLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel" } ], "repeated": 0, "id": 104 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE\\AppCompat" }, { "name": "Handle", "value": "0x00000278" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat" } ], "repeated": 0, "id": 105 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000278" }, { "name": "ValueName", "value": "RaiseDefaultAuthnLevel" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel" } ], "repeated": 0, "id": 106 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 107 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000256" }, { "name": "ValueName", "value": "AccessPermission" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80\\x90\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00`\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission" } ], "repeated": 0, "id": 108 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000256" } ], "repeated": 0, "id": 109 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 110 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 111 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 112 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255939000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 113 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c071840", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000278" } ], "repeated": 0, "id": 114 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "Handle", "value": "0x0000027a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" } ], "repeated": 0, "id": 115 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 116 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 117 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00z\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xd0\\xe4\r\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 118 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" } ], "repeated": 0, "id": 119 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 120 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000027a" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs" } ], "repeated": 0, "id": 121 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 122 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000027a" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 123 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)" } ], "repeated": 0, "id": 124 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Shield Provider User Session Agent" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)" } ], "repeated": 0, "id": 125 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000027a" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000027e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocServer32" } ], "repeated": 0, "id": 126 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 127 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 128 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 129 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 130 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027e" } ], "repeated": 0, "id": 131 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 132 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 133 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe2\r\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00z\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00`\\xe3\r\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 134 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" } ], "repeated": 0, "id": 135 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 136 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000027a" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32" } ], "repeated": 0, "id": 137 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 138 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 139 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "`\\xe2\r\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00z\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00`\\xe3\r\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 140 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" } ], "repeated": 0, "id": 141 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000027a" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 142 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000027a" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler" } ], "repeated": 0, "id": 143 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000027a" } ], "repeated": 0, "id": 144 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 145 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 146 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\system32\\rpcss.dll" }, { "name": "ModuleHandle", "value": "0x0000000c" } ], "repeated": 0, "id": 147 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 148 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00001470" }, { "name": "EventName", "value": "MSFT.VSA.COM.DISABLE.5232" } ], "repeated": 0, "id": 149 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "synchronization", "api": "NtOpenEvent", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "Handle", "value": "0x00000000" }, { "name": "EventName", "value": "MSFT.VSA.IEC.STATUS.6c736db0" } ], "repeated": 0, "id": 150 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25593b000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 151 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25593c000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 152 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{00000134-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000286" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 153 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000286" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000028a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 154 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 155 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028a" } ], "repeated": 0, "id": 156 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000286" } ], "repeated": 0, "id": 157 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 158 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000284" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 159 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000288" } ], "repeated": 0, "id": 160 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 161 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xbd\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00" } ], "repeated": 0, "id": 162 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xb4\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\\\x00W\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00" } ], "repeated": 0, "id": 163 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 164 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8@\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 165 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 166 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xb3\\x91U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 167 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00#\\xf6c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x80\\xe5\r\\xa5\\x98\\x00\\x00\\x00x\\xe5\r\\xa5\\x98\\x00\\x00\\x00H\\xe5\r\\xa5\\x98\\x00\\x00\\x00h\\xe5\r\\xa5" } ], "repeated": 0, "id": 168 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb3\\x91U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 169 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25593e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 170 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 171 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xb4\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00H\\x00e\\x00a\\x00l\\x00t\\x00h\\x00A\\x00g\\x00e\\x00n\\x00t\\x00.\\x00" } ], "repeated": 0, "id": 172 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xb5\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 173 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 174 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98>\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 175 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 176 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xe7\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 177 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00C\\xf2c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xe0\\xe1\r\\xa5\\x98\\x00\\x00\\x00\\xd8\\xe1\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe1\r\\xa5\\x98\\x00\\x00\\x00\\xc8\\xe1\r\\xa5" } ], "repeated": 0, "id": 178 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xe7\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xdf\r\\xa5\\x98\\x00\\x00\\x00\\x88\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 179 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000284" } ], "repeated": 0, "id": 180 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 181 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "misc", "api": "GetSystemInfo", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 182 }, { "timestamp": "2026-05-29 01:20:01,386", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 183 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "threading", "api": "NtCreateThreadEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ThreadHandle", "value": "0x0000028c" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1a255928210" }, { "name": "CreateFlags", "value": "0x00000001" }, { "name": "ThreadId", "value": "8336" }, { "name": "ProcessId", "value": "5232" }, { "name": "Module", "value": "combase.dll" } ], "repeated": 0, "id": 184 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "threading", "api": "CreateRemoteThreadEx", "status": true, "return": "0x0000028c", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "StartRoutine", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1a255928210" }, { "name": "CreationFlags", "value": "0x00000000" }, { "name": "ThreadId", "value": "8336" }, { "name": "ProcessId", "value": "5232" } ], "repeated": 0, "id": 185 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 186 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 187 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 188 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 189 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 190 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xb4\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 191 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xb5\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 192 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 193 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HC\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 194 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 195 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255940000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 196 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8336", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 197 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\n\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 198 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8336", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff58542d30" }, { "name": "Parameter", "value": "0x1a255928210" } ], "repeated": 0, "id": 199 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf3\\xcbc\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xe9\r\\xa5\\x98\\x00\\x00\\x00H\\xe9\r\\xa5\\x98\\x00\\x00\\x00\\x18\\xe9\r\\xa5\\x98\\x00\\x00\\x008\\xe9\r\\xa5" } ], "repeated": 0, "id": 200 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 201 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\x07\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 202 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\x02\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 203 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 204 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8@\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 205 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 206 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 207 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x13\\xf6c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe5\r\\xa5\\x98\\x00\\x00\\x00x\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\x98\\xe5\r\\xa5" } ], "repeated": 0, "id": 208 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 209 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 210 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 211 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 212 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 213 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000028c" } ], "repeated": 0, "id": 214 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 215 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xb4\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 216 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xb5\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 217 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 218 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98>\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 219 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 220 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xff\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 221 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf3\\xcbc\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xe9\r\\xa5\\x98\\x00\\x00\\x00H\\xe9\r\\xa5\\x98\\x00\\x00\\x00\\x18\\xe9\r\\xa5\\x98\\x00\\x00\\x008\\xe9\r\\xa5" } ], "repeated": 0, "id": 222 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xff\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\r\\xa5\\x98\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 223 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 224 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 225 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xfc\\x93U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 226 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 227 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xd8@\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 228 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 229 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\\xfd\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 230 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x13\\xf6c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe5\r\\xa5\\x98\\x00\\x00\\x00x\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\x98\\xe5\r\\xa5" } ], "repeated": 0, "id": 231 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfd\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 232 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 233 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 234 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 235 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000028c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 236 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000294" } ], "repeated": 0, "id": 237 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 238 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xb4\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 239 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xb5\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 240 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 241 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08A\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 242 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 243 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 244 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf3\\xcbc\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xe9\r\\xa5\\x98\\x00\\x00\\x00H\\xe9\r\\xa5\\x98\\x00\\x00\\x00\\x18\\xe9\r\\xa5\\x98\\x00\\x00\\x008\\xe9\r\\xa5" } ], "repeated": 0, "id": 245 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\r\\xa5\\x98\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 246 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 247 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\x0b\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 248 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\x02\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 249 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 250 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HC\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 251 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 252 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xff\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 253 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x13\\xf6c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe5\r\\xa5\\x98\\x00\\x00\\x00x\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\x98\\xe5\r\\xa5" } ], "repeated": 0, "id": 254 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xff\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x94\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 255 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 256 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 257 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 258 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000294" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 259 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000028c" } ], "repeated": 0, "id": 260 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 261 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xb4\\x91U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00" } ], "repeated": 0, "id": 262 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\xb5\\x91U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 263 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 264 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "HC\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 265 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 266 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\x07\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 267 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xf3\\xcbc\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00P\\xe9\r\\xa5\\x98\\x00\\x00\\x00H\\xe9\r\\xa5\\x98\\x00\\x00\\x00\\x18\\xe9\r\\xa5\\x98\\x00\\x00\\x008\\xe9\r\\xa5" } ], "repeated": 0, "id": 268 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x07\\x94U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\r\\xa5\\x98\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 269 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 270 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xfd\\x93U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 271 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\\x06\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 272 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 273 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x98>\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 274 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 275 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xf8\t\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 276 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x13\\xf6c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe5\r\\xa5\\x98\\x00\\x00\\x00x\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\x98\\xe5\r\\xa5" } ], "repeated": 0, "id": 277 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\t\\x94U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x8c\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 278 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000294" } ], "repeated": 0, "id": 279 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000028c" } ], "repeated": 0, "id": 280 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 281 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8436", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 282 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8436", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x1a255900b50" } ], "repeated": 0, "id": 283 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8436", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x000002a8" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 284 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8436", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255942000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 285 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255944000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 286 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 287 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 288 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b4" } ], "repeated": 0, "id": 289 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 290 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\x03\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 291 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xa0\\x06\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 292 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 293 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "xC\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 294 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 295 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xfe\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 296 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xc3\\xf5c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00`\\xe7\r\\xa5\\x98\\x00\\x00\\x00X\\xe7\r\\xa5\\x98\\x00\\x00\\x00(\\xe7\r\\xa5\\x98\\x00\\x00\\x00H\\xe7\r\\xa5" } ], "repeated": 0, "id": 297 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xfe\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe5\r\\xa5\\x98\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 298 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 299 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\x03\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 300 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xff\\x93U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 301 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 302 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "XB\\x93U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 303 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 304 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\xfd\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 305 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00c\\xf0c\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xc0\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\xb8\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\x88\\xe3\r\\xa5\\x98\\x00\\x00\\x00\\xa8\\xe3\r\\xa5" } ], "repeated": 0, "id": 306 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xfd\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xe1\r\\xa5\\x98\\x00\\x00\\x00\\xb4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 307 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255945000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 308 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 309 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 310 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "Software\\Microsoft\\OLE" }, { "name": "Handle", "value": "0x000002b4" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE" } ], "repeated": 0, "id": 311 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b4" }, { "name": "ValueName", "value": "MaxSxSHashCount" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount" } ], "repeated": 0, "id": 312 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 313 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 314 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c072480", "parentcaller": "0x7ff71c071938", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 315 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "6740", "caller": "0x7ff71c07b0df", "parentcaller": "0x7ff71c071979", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 316 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000294" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 317 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255948000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 318 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "b\"\\x10\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x04\\x00\\x00\\x00#\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 319 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 320 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25594a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 321 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742bf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 322 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585742e9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 323 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574313", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "StringFromIID" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58549780" } ], "repeated": 0, "id": 324 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff5857433d", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemAlloc" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58552e80" } ], "repeated": 0, "id": 325 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574367", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoTaskMemFree" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58551b70" } ], "repeated": 0, "id": 326 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff58574391", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoCreateInstance" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ca420" } ], "repeated": 0, "id": 327 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff585743bb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 328 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff585741cf", "parentcaller": "0x7fff59f938c0", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "0000032A-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000149-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 329 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff58568ae1", "parentcaller": "0x7fff58557ab3", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002b0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 330 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff584f1e2e", "parentcaller": "0x7fff58557a49", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 331 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000338-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 332 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 333 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 334 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7ff71c071d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 335 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7ff71c071d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 336 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7ff71c071d7f", "parentcaller": "0x00000000", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthAgent" }, { "name": "DllBase", "value": "0x1a258bb0000" } ], "repeated": 0, "id": 337 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7ff71c071d7f", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthAgent.dll" }, { "name": "BaseAddress", "value": "0x1a258bb0000" } ], "repeated": 0, "id": 338 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7ff71c071d7f", "parentcaller": "0x00000000", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "08728914-3F57-4D52-9E31-49DAECA5A80A" }, { "name": "ClsContext", "value": "0x00000001", "pretty_value": "CLSCTX_INPROC_SERVER" }, { "name": "riid", "value": "00000000-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 339 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}" }, { "name": "Handle", "value": "0x000002be" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}" } ], "repeated": 0, "id": 340 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002be" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x000002b2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 341 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 342 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" } ], "repeated": 0, "id": 343 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" } ], "repeated": 0, "id": 344 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002be" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 345 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 346 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 347 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\xbb\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xb0\\xbc\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 348 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 349 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 350 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 351 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 352 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 353 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 354 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Security Health Agent Proxy Stub Factory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 355 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002be" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002b2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32" } ], "repeated": 0, "id": 356 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 357 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 358 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 359 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 360 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" } ], "repeated": 0, "id": 361 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 362 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 363 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xba\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00@\\xbb\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 364 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 365 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 366 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 367 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 368 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 369 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xba\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00@\\xbb\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 370 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 371 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 372 }, { "timestamp": "2026-05-29 01:20:01,402", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 373 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" } ], "repeated": 0, "id": 374 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 375 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 376 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002be" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 377 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 378 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 379 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\xb8\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00p\\xb9\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 380 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 381 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 382 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 383 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 384 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 385 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 386 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Security Health Agent Proxy Stub Factory" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)" } ], "repeated": 0, "id": 387 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x000002be" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x000002b2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32" } ], "repeated": 0, "id": 388 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 389 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 390 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577f4aa9", "parentcaller": "0x7fff577d31c6", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "%windir%\\system32\\SecurityHealthAgent.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)" } ], "repeated": 1, "id": 391 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 392 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" } ], "repeated": 0, "id": 393 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 394 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 395 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xb7\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x00\\xb8\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 396 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 397 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 398 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32" } ], "repeated": 0, "id": 399 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 400 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 401 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\x00\\xb7\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x00\\xb8\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 402 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 403 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 404 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler" } ], "repeated": 0, "id": 405 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002be" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer32" } ], "repeated": 0, "id": 406 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x000002be" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID" } ], "repeated": 0, "id": 407 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 408 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 409 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xb6\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00\\xbe\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00@\\xb7\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 410 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" } ], "repeated": 0, "id": 411 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002be" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 412 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000002be" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer" } ], "repeated": 0, "id": 413 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002b2" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 414 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002b2" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\Elevation" } ], "repeated": 0, "id": 415 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b2" } ], "repeated": 0, "id": 416 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" } ], "repeated": 0, "id": 417 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" }, { "name": "Handle", "value": "0x000002be" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } ], "repeated": 0, "id": 418 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x000002be" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs" } ], "repeated": 0, "id": 419 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002be" } ], "repeated": 0, "id": 420 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 421 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 422 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 423 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x000002bc" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 424 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x000002b0" } ], "repeated": 0, "id": 425 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 426 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xd8\\xfc\\x93U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 427 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00\\xfe\\x93U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 428 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 429 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "H\\xc5\\x94U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 430 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 431 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xfe\\x93U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 432 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xa3\\xea\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x00\\xca\\x7f\\xa5\\x98\\x00\\x00\\x00\\xf8\\xc9\\x7f\\xa5\\x98\\x00\\x00\\x00\\xc8\\xc9\\x7f\\xa5\\x98\\x00\\x00\\x00\\xe8\\xc9\\x7f\\xa5" } ], "repeated": 0, "id": 433 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xfe\\x93U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xc7\\x7f\\xa5\\x98\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 434 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 435 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\n\\x94U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 436 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "@\t\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 437 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 438 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xc8\\xc3\\x94U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 439 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 440 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x98\\x00\\x94U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 441 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xc3\\x96\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00`\\xc6\\x7f\\xa5\\x98\\x00\\x00\\x00X\\xc6\\x7f\\xa5\\x98\\x00\\x00\\x00(\\xc6\\x7f\\xa5\\x98\\x00\\x00\\x00H\\xc6\\x7f\\xa5" } ], "repeated": 0, "id": 442 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\x94U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xc4\\x7f\\xa5\\x98\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 443 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002bc" } ], "repeated": 0, "id": 444 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 445 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584e0e64", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" } ], "repeated": 0, "id": 446 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e82", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoGetMarshalSizeMax" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5850c590" } ], "repeated": 0, "id": 447 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0e9f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoMarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff5851b0b0" } ], "repeated": 0, "id": 448 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ebc", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoUnmarshalInterface" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff58518b50" } ], "repeated": 0, "id": 449 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584e0ed9", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "combase.dll" }, { "name": "ModuleHandle", "value": "0x7fff584a0000" }, { "name": "FunctionName", "value": "CoReleaseMarshalData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff584ce790" } ], "repeated": 0, "id": 450 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255950000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 451 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f867b9", "parentcaller": "0x7fff5780ced6", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 452 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577ce76a", "parentcaller": "0x1a258bb6b19", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 453 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb6b36", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 454 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb37e7", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 455 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb70c5", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 456 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb375a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 457 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb4175", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 458 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x1a258bb36cb", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 459 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577ced78", "parentcaller": "0x1a258bb7b5e", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "MutexName", "value": "Local\\SM0:5232:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 460 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x1a258bb7b8c", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 461 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x1a258bb45b9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 462 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x1a258bb45b9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 463 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x1a258bb45b9", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 464 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x1a258bb45b9", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 465 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x1a258bb4267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 466 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x1a258bb4267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f0" } ], "repeated": 0, "id": 467 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577cdd5d", "parentcaller": "0x1a258bb4297", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 468 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x1a258bb4267", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ec" } ], "repeated": 0, "id": 469 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 470 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 471 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthProxyStub" }, { "name": "DllBase", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 472 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 473 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x1a258bee56d", "parentcaller": "0x1a258bbf907", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "434AEC1C-8583-45EC-B88F-750D6F380BC3" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "DFD80D65-D501-43B2-A8FF-86617BD81EA7" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 474 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 475 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 476 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff58568ae1", "parentcaller": "0x7fff584f7545", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000002fc" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime" } ], "repeated": 0, "id": 477 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584f74a2", "parentcaller": "0x7fff584f67e6", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000300" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x000002fc" }, { "name": "ObjectAttributesName", "value": "ActivatableClassId" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId" } ], "repeated": 0, "id": 478 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Windows.Data.Xml.Dom.XmlDocument" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument" } ], "repeated": 0, "id": 479 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000304" }, { "name": "KeyInformation", "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00.\\x00X\\x00m\\x00l\\x00.\\x00D\\x00o\\x00m\\x00.\\x00X\\x00m\\x00l\\x00D\\x00o\\x00c\\x00u\\x00m\\x00e\\x00n\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x00I\\xff95U\\xffa2\\x01\\x00\\x00\\xfff8\\xff81\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xffa2\\x01\\x00\\x00\\x03\\xffed\\x11\\xff82\\x107\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\xffc8\\xffc9\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xffb3\\xffe8\\x11\\xff82\\x107\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80G\\xff93U\\xffa2\\x01\\x00\\x00\\xff90\\xffa3\\xffbfX\\xffa2\\x01\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xff90\\xff9c\\xff92U\\xffa2\\x01\\x00\\x00\\x10\\xffca\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xffe4I\\xffb9\\x17\\xffff\\x7f\\x00\\x00\\xff90\\xffa3\\xffbfX\\xffa2\\x01\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xfffc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00;\\x1a\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xff90\\xff9c\\xff92U\\xffa2\\x01\\x00\\x00\\xfff8\\xff81\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xffa2\\x01\\x00\\x00h\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\xfffc\\x02\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x00\\xffca\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xff98\\xff85\\xffdb\\x17\\xffff\\x7f\\x00\\x00\\x10\\xffca\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xfff0\\xff9a\\xff92U\\xffa2\\x01\\x00\\x00\\xffb0tOX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xff90\\xffcb\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xff90\\xff9c\\xff92U\\xffa2\\x01\\x00\\x00\\xff80G\\xff93U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\x0c\\xff9b\\xff92U\\xffa2\\x01\\x00\\x000\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xfffc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffca\\x7f\\xffa5\\xff98\\x00\\x00\\x00@\\x00\\x00\\x00\\xff98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xff9c\\xff92U\\xffa2\\x01\\x00\\x00\\x19hOX\\xffff\\x7f\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 480 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType" } ], "repeated": 0, "id": 481 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server" } ], "repeated": 0, "id": 482 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath" } ], "repeated": 0, "id": 483 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading" } ], "repeated": 0, "id": 484 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel" } ], "repeated": 0, "id": 485 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000304" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\CustomAttributes" } ], "repeated": 0, "id": 486 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer" } ], "repeated": 0, "id": 487 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser" } ], "repeated": 0, "id": 488 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker" } ], "repeated": 0, "id": 489 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 490 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "Permissions" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions" } ], "repeated": 0, "id": 491 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000304" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags" } ], "repeated": 0, "id": 492 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff58577dd4", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x80000002", "pretty_value": "HKEY_LOCAL_MACHINE" }, { "name": "SubKey", "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis" } ], "repeated": 0, "id": 493 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 494 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 495 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "BaseAddress", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 496 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff52b60000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\msxml6.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 497 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52b6be70" } ], "repeated": 0, "id": 498 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52b6bde0" } ], "repeated": 0, "id": 499 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "ModuleHandle", "value": "0x7fff52b60000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff52be6480" } ], "repeated": 0, "id": 500 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc6000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 501 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc9000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 502 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fccc72", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "DesiredAccess", "value": "0x00000009", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager" } ], "repeated": 0, "id": 503 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fccca1", "parentcaller": "0x7fff59f938c0", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000314" }, { "name": "ValueName", "value": "ResourcePolicies" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies" } ], "repeated": 0, "id": 504 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fcccb7", "parentcaller": "0x7fff59f938c0", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 505 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f948aa", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258d60000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 506 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f94901", "parentcaller": "0x7fff59f94b80", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258d60000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 507 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dcb000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 508 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc18a2", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258d61000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 509 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e46f", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd0000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 510 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e4f0", "parentcaller": "0x7fff59f7dbfa", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd0000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 511 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd2000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 512 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd3000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 513 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 514 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 515 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 516 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd7000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 517 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd9000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 518 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ddb000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 519 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff52c10873", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000031c" } ], "repeated": 0, "id": 520 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff52c108bb", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 521 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52c108fe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 522 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cdb75", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 523 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 524 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52d8e000" }, { "name": "ModuleName", "value": "msxml6.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 525 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ddd000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 526 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 527 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de1000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 528 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de3000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 529 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de8000" }, { "name": "RegionSize", "value": "0x00005000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 530 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x1a258bef202", "parentcaller": "0x1a258bdd644", "category": "misc", "api": "FindResourceExW", "status": true, "return": "0x1a258da08a8", "arguments": [ { "name": "Module", "value": "0x1a258bb0000" }, { "name": "Type", "value": "#6" }, { "name": "Name", "value": "#688" }, { "name": "Language", "value": "0x00000000" } ], "repeated": 0, "id": 531 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x1a258bef2ba", "parentcaller": "0x1a258bef25c", "category": "misc", "api": "LoadResource", "status": true, "return": "0x1a258da5734", "arguments": [ { "name": "Module", "value": "0x1a258bb0000" }, { "name": "ResourceInfo", "value": "0x1a258da08a8" } ], "repeated": 0, "id": 532 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x1a258bef34e", "parentcaller": "0x1a258bef25c", "category": "misc", "api": "SizeofResource", "status": true, "return": "0x00000164", "arguments": [ { "name": "ModuleHandle", "value": "0x1a258bb0000" }, { "name": "ResourceInfo", "value": "0x1a258da08a8" } ], "repeated": 0, "id": 533 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Notifications.ToastNotificationManager" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager" } ], "repeated": 0, "id": 534 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000320" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\xff94U\\xffa2\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90U\\xffa2\\x01\\x00\\x00\t\\xffc6\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x0e\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\xffc4\\x02\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x008I\\xff94U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc6\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xfff0P\\xff94U\\xffa2\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10I\\xff94U\\xffa2\\x01\\x00\\x00\\xfff0P\\xff94U\\xffa2\\x01\\x00\\x00\\xffb0K\\xff95U\\xffa2\\x01\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffb0s\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffb0K\\xff95U\\xffa2\\x01\\x00\\x00\\xff80G\\xff93U\\xffa2\\x01\\x00\\x00\\xff80G\\xff93U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0P\\xff94U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffc0\\xff9d\\xff92U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xff98\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc7\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc7\\x7f\\xffa5\\xff98\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 535 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType" } ], "repeated": 0, "id": 536 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server" } ], "repeated": 0, "id": 537 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath" } ], "repeated": 0, "id": 538 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading" } ], "repeated": 0, "id": 539 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel" } ], "repeated": 0, "id": 540 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000320" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes" } ], "repeated": 0, "id": 541 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer" } ], "repeated": 0, "id": 542 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser" } ], "repeated": 0, "id": 543 }, { "timestamp": "2026-05-29 01:20:01,417", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker" } ], "repeated": 0, "id": 544 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 545 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x9800000003" }, { "name": "DataLength", "value": "316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 546 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions" } ], "repeated": 0, "id": 547 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000320" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags" } ], "repeated": 0, "id": 548 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 549 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff585778a1", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000320" } ], "repeated": 0, "id": 550 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff58577950", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xca\\x7f\\xa5\\x98\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\xff\\xff\\xff\\xf8\\x81\\xdb\\x17\\xff\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf8\\xca\\x7f\\xa5\\x98\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x02\\x81W\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 551 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff585778d3", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 552 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 553 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 554 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 555 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 556 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 557 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 558 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fb7cc6", "parentcaller": "0x7fff59f8ddf7", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 559 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "BaseAddress", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 560 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff40fb0000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 561 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fc7a60" } ], "repeated": 0, "id": 562 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fc7d00" } ], "repeated": 0, "id": 563 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "ModuleHandle", "value": "0x7fff40fb0000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff40fcb840" } ], "repeated": 0, "id": 564 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 565 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 566 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 567 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5855dd9d", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000360" }, { "name": "DesiredAccess", "value": "0x00020119", "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED" }, { "name": "ObjectAttributesHandle", "value": "0x00000300" }, { "name": "ObjectAttributesName", "value": "Windows.UI.Notifications.ToastNotification" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification" } ], "repeated": 0, "id": 568 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5855ddf7", "parentcaller": "0x7fff584f7428", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000360" }, { "name": "KeyInformation", "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000i\\xff94U\\xffa2\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90U\\xffa2\\x01\\x00\\x00\t\\xffc6\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x0e\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\xffc4\\x02\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffa0U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0EzX\\xffff\\x7f\\x00\\x00H`\\xff94U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc6\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\xff87\\xff9dNX\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x00\\xffb0p\\xff95U\\xffa2\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 `\\xff94U\\xffa2\\x01\\x00\\x00\\xffb0p\\xff95U\\xffa2\\x01\\x00\\x000\\xffcb\\xff95U\\xffa2\\x01\\x00\\x00\\xffc7\\xffb3\\xfff7Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffa0U\\xffa2\\x01\\x00\\x00\\xfff6sNX\\xffff\\x7f\\x00\\x00\\xffb0q\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff0\\xffcb\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\xffe2\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\xffe2\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0p\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}Y\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xffa2\\x01\\x00\\x006\\xff8cYX\\xffff\\x7f\\x00\\x00\\xffb0\\xff89\\xff95U\\xffa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xff98\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc7\\x7f\\xffa5\\xff98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc7\\x7f\\xffa5\\xff98\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "0" } ], "repeated": 0, "id": 569 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "ActivationType" }, { "name": "Data", "value": "0" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType" } ], "repeated": 0, "id": 570 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "Server" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server" } ], "repeated": 0, "id": 571 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff585700bb", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "DllPath" }, { "name": "Data", "value": "C:\\Windows\\System32\\wpnapps.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath" } ], "repeated": 0, "id": 572 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "Threading" }, { "name": "Data", "value": "2" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading" } ], "repeated": 0, "id": 573 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "TrustLevel" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel" } ], "repeated": 0, "id": 574 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584bc0fc", "parentcaller": "0x7fff58554170", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000360" }, { "name": "SubKey", "value": "CustomAttributes" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\CustomAttributes" } ], "repeated": 0, "id": 575 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584b7deb", "parentcaller": "0x7fff58568ff0", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "RemoteServer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer" } ], "repeated": 0, "id": 576 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "ActivateAsUser" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser" } ], "repeated": 0, "id": 577 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "ActivateInSharedBroker" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker" } ], "repeated": 0, "id": 578 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "ActivateInBrokerForMediumILContainer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer" } ], "repeated": 0, "id": 579 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x000000ea", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Type", "value": "0x9800000003" }, { "name": "DataLength", "value": "316" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions" } ], "repeated": 0, "id": 580 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58562222", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "Permissions" }, { "name": "Data", "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions" } ], "repeated": 0, "id": 581 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff58559cb2", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000360" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags" } ], "repeated": 0, "id": 582 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff58557226", "parentcaller": "0x7fff5855ca23", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 583 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 584 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8436", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255960000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 585 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 586 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 587 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 588 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 589 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000360" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000364" } ], "repeated": 0, "id": 590 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 591 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe0\\x98\\x95U\\xa2\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08\\x99\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x99\\x95U\\xa2\\x01\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 592 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 593 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 594 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 595 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xc2\\x94U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00d\\x00T\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 596 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 597 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 598 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 599 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 600 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58928000" }, { "name": "ModuleName", "value": "OLEAUT32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 601 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5a00e53f", "parentcaller": "0x7fff59f6faf7", "category": "process", "api": "NtSetInformationProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessInformationClass", "value": "93" }, { "name": "ProcessInformation", "value": "\\x7f7\\x9e}" } ], "repeated": 0, "id": 602 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f65157", "parentcaller": "0x7fff59f643ea", "category": "process", "api": "NtOpenSection", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "SectionHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x0000000d" }, { "name": "ObjectAttributes", "value": "usermgrcli.dll" } ], "repeated": 0, "id": 603 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59faf37b", "parentcaller": "0x7fff59faf207", "category": "filesystem", "api": "NtQueryAttributesFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 604 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fafc9c", "parentcaller": "0x7fff59fafa80", "category": "filesystem", "api": "NtOpenFile", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileHandle", "value": "0x00000360" }, { "name": "DesiredAccess", "value": "0x00100021", "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" }, { "name": "ShareAccess", "value": "5", "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE" } ], "repeated": 0, "id": 605 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fafcfe", "parentcaller": "0x7fff59fafa80", "category": "process", "api": "NtCreateSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000364" }, { "name": "DesiredAccess", "value": "0x0000000d", "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE" }, { "name": "ObjectAttributes", "value": "" }, { "name": "FileHandle", "value": "0x00000360" }, { "name": "FileName", "value": "C:\\Windows\\System32\\usermgrcli.dll" } ], "repeated": 0, "id": 606 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f64d42", "parentcaller": "0x7fff59f64aaa", "category": "process", "api": "NtMapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "SectionHandle", "value": "0x00000364" }, { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "SectionOffset", "value": "0x00000000" }, { "name": "ViewSize", "value": "0x00016000" }, { "name": "Win32Protect", "value": "0x00000080", "pretty_value": "PAGE_EXECUTE_WRITECOPY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 607 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f5fee4", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff524a3000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 608 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f5ffb5", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 609 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f5ffed", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 610 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f60068", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 611 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f6009c", "parentcaller": "0x7fff59f5fad8", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249c000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 612 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f65082", "parentcaller": "0x7fff59f679d2", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 613 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fafd68", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000364" } ], "repeated": 0, "id": 614 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fafd71", "parentcaller": "0x7fff59fafa80", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000360" } ], "repeated": 0, "id": 615 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5249b000" }, { "name": "ModuleName", "value": "usermgrcli.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00002000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 616 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97bac", "parentcaller": "0x7fff59f8288a", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 617 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59fbc2c7", "parentcaller": "0x7fff59fbc05a", "category": "system", "api": "LdrpCallInitRoutine", "status": true, "return": "0x00000001", "arguments": [ { "name": "MappedPath", "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\usermgrcli" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "InitRoutine", "value": "0x7fff52494250" }, { "name": "Reason", "value": "1" } ], "repeated": 0, "id": 618 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 619 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 620 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 621 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" }, { "name": "Handle", "value": "0x0000036e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}" } ], "repeated": 0, "id": 622 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 623 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 624 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "@\\xac\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00n\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00@\\xad\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 625 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 626 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 627 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036e" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs" } ], "repeated": 0, "id": 628 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 629 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036e" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "Data", "value": "1" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 630 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036e" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 631 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "Windows Push Notification Platform" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)" } ], "repeated": 0, "id": 632 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000036e" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32" } ], "repeated": 0, "id": 633 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 634 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 635 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xaa\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00n\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xd0\\xab\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 636 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 637 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 638 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036e" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32" } ], "repeated": 0, "id": 639 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 640 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 641 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xd0\\xaa\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00n\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xd0\\xab\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 642 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 643 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036e" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 644 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x0000036e" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler" } ], "repeated": 0, "id": 645 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036e" } ], "repeated": 0, "id": 646 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 647 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 648 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 649 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 650 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000c4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers" } ], "repeated": 0, "id": 651 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5854f195", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036c" }, { "name": "ValueName", "value": "WaitForRestore" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore" } ], "repeated": 0, "id": 652 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5854f195", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 653 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3a9c", "parentcaller": "0x7fff577d3529", "category": "misc", "api": "RtlSetCurrentTransaction", "status": true, "return": "0x00000001", "arguments": [ { "name": "TransactionHandle", "value": "0x00000000" } ], "repeated": 1, "id": 654 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d3f4b", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000c4" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 655 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3f76", "parentcaller": "0x7fff57854fd4", "category": "registry", "api": "NtOpenKeyEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x0000036c" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x000000c4" }, { "name": "ObjectAttributesName", "value": "SOFTWARE\\Microsoft\\OLE" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE" } ], "repeated": 0, "id": 656 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2fe4", "parentcaller": "0x7fff5854ca47", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036c" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags" } ], "repeated": 0, "id": 657 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d3018", "parentcaller": "0x7fff5854ca47", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 658 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 659 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255962000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 660 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255965000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 661 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 662 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}" } ], "repeated": 0, "id": 663 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32" } ], "repeated": 0, "id": 664 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 665 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 666 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 667 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 668 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 669 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 670 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": " \\x9c\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00 \\x9d\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 671 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 672 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 673 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 674 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 675 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 676 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 677 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 678 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 679 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 680 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 681 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 682 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 683 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 684 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 685 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 686 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\x9a\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xb0\\x9b\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 687 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 688 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 689 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 690 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 691 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 692 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\x9a\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xb0\\x9b\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 693 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 694 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 695 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 696 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 697 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 698 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 699 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff584d7b74", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 700 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 701 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 702 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xe0\\x98\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xe0\\x99\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 703 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 704 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 705 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "TreatAs" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 706 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff585622e1", "parentcaller": "0x7fff584d7c1d", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 707 }, { "timestamp": "2026-05-29 01:20:01,433", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d81f5", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "ActivateOnHostFlags" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags" } ], "repeated": 0, "id": 708 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 709 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "PSFactoryBuffer" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)" } ], "repeated": 0, "id": 710 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d8485", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "InprocServer32" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32" } ], "repeated": 0, "id": 711 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "InprocServer32" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32" } ], "repeated": 0, "id": 712 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d870d", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 713 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d87bc", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)" } ], "repeated": 0, "id": 714 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584d8d32", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" }, { "name": "ValueName", "value": "ThreadingModel" }, { "name": "Data", "value": "Both" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel" } ], "repeated": 0, "id": 715 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d855f", "parentcaller": "0x7fff584d829e", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 716 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 717 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 718 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\x97\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00p\\x98\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 719 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 720 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 721 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "InprocHandler32" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32" } ], "repeated": 0, "id": 722 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 723 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 724 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "p\\x97\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00p\\x98\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 725 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 726 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 727 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "InprocHandler" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler" } ], "repeated": 0, "id": 728 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584dab08", "parentcaller": "0x7fff584da7d9", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "LocalServer32" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32" } ], "repeated": 0, "id": 729 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2e92", "parentcaller": "0x7fff584da825", "category": "registry", "api": "RegQueryValueExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Handle", "value": "0x00000366" }, { "name": "ValueName", "value": "AppID" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID" } ], "repeated": 0, "id": 730 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d45a7", "parentcaller": "0x7fff577d0705", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "KeyInformationClass", "value": "3" } ], "repeated": 0, "id": 731 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d2314", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 732 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f86c8b", "parentcaller": "0x7fff577d23a0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "1" }, { "name": "TokenInformation", "value": "\\xb0\\x96\\x7f\\xa5\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\xdb\\x17\\xff\\x7f\\x00\\x00f\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\xdb\\x17\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\xb0\\x97\\x7f\\xa5\\x98\\x00\\x00\\x00" } ], "repeated": 0, "id": 733 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d24a8", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 734 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d40c4", "parentcaller": "0x7fff577d25c4", "category": "registry", "api": "NtQueryKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x00000366" }, { "name": "KeyInformation", "value": "\\x00\\x00\\x00\\x00" }, { "name": "KeyInformationClass", "value": "7" } ], "repeated": 0, "id": 735 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d25e2", "parentcaller": "0x7fff577d0732", "category": "registry", "api": "NtOpenKeyEx", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x00000000" }, { "name": "DesiredAccess", "value": "0x00000001", "pretty_value": "KEY_QUERY_VALUE" }, { "name": "ObjectAttributesHandle", "value": "0x00000366" }, { "name": "ObjectAttributesName", "value": "LocalServer" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer" } ], "repeated": 0, "id": 736 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584dad16", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000024e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x0000036a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 737 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584dad4d", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x0000036a" }, { "name": "SubKey", "value": "Elevation" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation" } ], "repeated": 0, "id": 738 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584dadb1", "parentcaller": "0x7fff584d83b8", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036a" } ], "repeated": 0, "id": 739 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d8010", "parentcaller": "0x7fff584d53d4", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 740 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff584d25e9", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "Handle", "value": "0x00000366" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } ], "repeated": 0, "id": 741 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5854f8f8", "parentcaller": "0x7fff584d213b", "category": "registry", "api": "RegOpenKeyExW", "status": false, "return": "0x00000002", "arguments": [ { "name": "Registry", "value": "0x00000366" }, { "name": "SubKey", "value": "TreatAs" }, { "name": "Handle", "value": "0x00000000" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs" } ], "repeated": 0, "id": 742 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d2160", "parentcaller": "0x7fff584c9277", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000366" } ], "repeated": 0, "id": 743 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 744 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 745 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 746 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff50870000" } ], "repeated": 0, "id": 747 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff50870000", "arguments": [ { "name": "lpLibFileName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" }, { "name": "dwFlags", "value": "0x00002008" } ], "repeated": 0, "id": 748 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6acf", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetClassObject" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff50886540" } ], "repeated": 0, "id": 749 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6ae8", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": false, "return": "0xffffffffc0000139", "pretty_return": "ENTRYPOINT_NOT_FOUND", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllGetActivationFactory" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x00000000" } ], "repeated": 0, "id": 750 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff584f6b08", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "OneCoreUAPCommonProxyStub.dll" }, { "name": "ModuleHandle", "value": "0x7fff50870000" }, { "name": "FunctionName", "value": "DllCanUnloadNow" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff508865f0" } ], "repeated": 0, "id": 751 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff597a1630", "parentcaller": "0x7fff597a12cd", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 752 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 753 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff5987e000" }, { "name": "ModuleName", "value": "RPCRT4.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 754 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255969000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 755 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59767be3", "parentcaller": "0x7fff597a15ab", "category": "system", "api": "NtQuerySystemTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 756 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 757 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" }, { "name": "Handle", "value": "0x00000326" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}" } ], "repeated": 0, "id": 758 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000326" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000032a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32" } ], "repeated": 0, "id": 759 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 760 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032a" } ], "repeated": 0, "id": 761 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000326" } ], "repeated": 0, "id": 762 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 763 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 764 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25596b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 765 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 766 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "load" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 767 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d56b2", "parentcaller": "0x7fff584f6b6d", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub.dll" }, { "name": "BaseAddress", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 768 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x1a258bee56d", "parentcaller": "0x1a258bdeeb5", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "F53321FA-34F8-4B7F-B9A3-361877CB94CF" }, { "name": "ClsContext", "value": "0x00000004", "pretty_value": "CLSCTX_LOCAL_SERVER" }, { "name": "riid", "value": "6BFF4732-81EC-4FFB-AE67-B6C1BC29631F" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 769 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff584ccd6e", "parentcaller": "0x7fff584cc76f", "category": "system", "api": "IsDebuggerPresent", "status": false, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 770 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000374" } ], "repeated": 0, "id": 771 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 772 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\xb7\\x96U\\xa2\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\xb7\\x96U\\xa2\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xb7\\x96U\\xa2\\x01\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 773 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000374" } ], "repeated": 0, "id": 774 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40ff9183", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 775 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 776 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00A\\x96U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00P\\x00E\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 777 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 778 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 779 }, { "timestamp": "2026-05-29 01:20:01,449", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 780 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 781 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 782 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25596e000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 783 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 784 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff40fca458", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 785 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd1c1e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlRegisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f593b0" } ], "repeated": 0, "id": 786 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca30a", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "NtQueryWnfStateData" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fefc40" } ], "repeated": 0, "id": 787 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca36e", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlSubscribeWnfStateChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59f92460" } ], "repeated": 0, "id": 788 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd1329", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDisownModuleHeapAllocation" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fcfa30" } ], "repeated": 0, "id": 789 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fd17ff", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlQueryFeatureConfiguration" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59facbd0" } ], "repeated": 0, "id": 790 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577dac31", "parentcaller": "0x7fff40fca41b", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 791 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577ced78", "parentcaller": "0x7fff40fc4988", "category": "synchronization", "api": "NtCreateMutant", "status": true, "return": "0x40000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "MutexName", "value": "Local\\SM0:5232:304:WilStaging_02" }, { "name": "InitialOwner", "value": "0" } ], "repeated": 0, "id": 792 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fd1504", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 793 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 794 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 795 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 796 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff40fc4dc1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 797 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 798 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 799 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577cdd5d", "parentcaller": "0x7fff40fcb31b", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 800 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fcb34b", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 801 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ded000" }, { "name": "RegionSize", "value": "0x00009000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 802 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f59b1a", "parentcaller": "0x7fff59f7095c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de6000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 803 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5ed8a", "parentcaller": "0x7fff59f764ab", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de6000" }, { "name": "RegionSize", "value": "0x0000f000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 804 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f59b1a", "parentcaller": "0x7fff59f7095c", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de3000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 805 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 806 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff410ea000" }, { "name": "ModuleName", "value": "wpnapps.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 807 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 808 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58117000" }, { "name": "ModuleName", "value": "shcore.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 809 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff577dcbb0", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000368" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000036c" } ], "repeated": 0, "id": 810 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577daa1f", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 811 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577daaa8", "parentcaller": "0x7fff577dcb7c", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "39" }, { "name": "TokenInformation", "value": "\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\xf3\\x96U\\xa2\\x01\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00H\\xf3\\x96U\\xa2\\x01\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xf3\\x96U\\xa2\\x01\\x00\\x00T\\x00S\\x00A\\x00:\\x00/\\x00/\\x00P\\x00r\\x00o\\x00c\\x00U\\x00n\\x00i\\x00q\\x00u\\x00e\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00Q\\xb7\\x06\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 812 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff577dcbbe", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000036c" } ], "repeated": 0, "id": 813 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbad54", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 814 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdb7d", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 815 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff40fbdc15", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x00A\\x96U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00P\\x00E\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00" } ], "repeated": 0, "id": 816 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff40fbdc8c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000368" } ], "repeated": 0, "id": 817 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 818 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 819 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 820 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 821 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255970000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 822 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255971000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 823 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 824 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff40fbb737", "parentcaller": "0x7fff40fd9f40", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 825 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff40fe6b78", "parentcaller": "0x7fff40fbb8b1", "category": "misc", "api": "NtQuerySystemInformation", "status": true, "return": "0x00000000", "arguments": [ { "name": "SystemInformationClass", "value": "3", "pretty_value": "FILE_OPEN_IF" } ], "repeated": 0, "id": 826 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" }, { "name": "Handle", "value": "0x00000372" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}" } ], "repeated": 0, "id": 827 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000372" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000376" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32" } ], "repeated": 0, "id": 828 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000376" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 829 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000376" } ], "repeated": 0, "id": 830 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000372" } ], "repeated": 0, "id": 831 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 832 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 833 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}" }, { "name": "Handle", "value": "0x0000037a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}" } ], "repeated": 0, "id": 834 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000037e" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32" } ], "repeated": 0, "id": 835 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037e" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 836 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037e" } ], "repeated": 0, "id": 837 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" } ], "repeated": 0, "id": 838 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 839 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 840 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 841 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 842 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x0000037c" } ], "repeated": 0, "id": 843 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 844 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "X\\xf6\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 845 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xed\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x03\\x00\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xaf\\x96U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 846 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 847 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x08C\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 848 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 849 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "X\\xf9\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 850 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x03\\x8a\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xa0\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00\\x98\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00h\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00\\x88\\xa9\\x7f\\xa5" } ], "repeated": 0, "id": 851 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xa7\\x7f\\xa5\\x98\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 852 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 853 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "8\\xf8\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 854 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xfa\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 855 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 856 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x88A\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 857 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 858 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "x\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 859 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xa3\\xb6\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x00\\xa6\\x7f\\xa5\\x98\\x00\\x00\\x00\\xf8\\xa5\\x7f\\xa5\\x98\\x00\\x00\\x00\\xc8\\xa5\\x7f\\xa5\\x98\\x00\\x00\\x00\\xe8\\xa5\\x7f\\xa5" } ], "repeated": 0, "id": 860 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xa3\\x7f\\xa5\\x98\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 861 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 862 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037c" } ], "repeated": 0, "id": 863 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}" }, { "name": "Handle", "value": "0x0000037e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}" } ], "repeated": 0, "id": 864 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000037a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32" } ], "repeated": 0, "id": 865 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 866 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" } ], "repeated": 0, "id": 867 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037e" } ], "repeated": 0, "id": 868 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 869 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 870 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 871 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000370" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 872 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000378" } ], "repeated": 0, "id": 873 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 874 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\x18\\xfa\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 875 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xf4\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 876 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 877 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8F\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 878 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 879 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xed\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 880 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x03\\x8a\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xa0\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00\\x98\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00h\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00\\x88\\xa9\\x7f\\xa5" } ], "repeated": 0, "id": 881 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xed\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xa7\\x7f\\xa5\\x98\\x00\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 882 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 883 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xf9\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 884 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xee\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 885 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 886 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xb8D\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 887 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 888 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xd8\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 889 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xa3\\xb6\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x00\\xa6\\x7f\\xa5\\x98\\x00\\x00\\x00\\xf8\\xa5\\x7f\\xa5\\x98\\x00\\x00\\x00\\xc8\\xa5\\x7f\\xa5\\x98\\x00\\x00\\x00\\xe8\\xa5\\x7f\\xa5" } ], "repeated": 0, "id": 890 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xa3\\x7f\\xa5\\x98\\x00\\x00\\x00x\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 891 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 892 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 893 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}" }, { "name": "Handle", "value": "0x0000037a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}" } ], "repeated": 0, "id": 894 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000037a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000372" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32" } ], "repeated": 0, "id": 895 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000372" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 896 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000372" } ], "repeated": 0, "id": 897 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000037a" } ], "repeated": 0, "id": 898 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 899 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 900 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 901 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000378" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 902 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000370" } ], "repeated": 0, "id": 903 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 904 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xf9\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 905 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xf6\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 906 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 907 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8C\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 908 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 909 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 910 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x13\\x88\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xb0\\xab\\x7f\\xa5\\x98\\x00\\x00\\x00\\xa8\\xab\\x7f\\xa5\\x98\\x00\\x00\\x00x\\xab\\x7f\\xa5\\x98\\x00\\x00\\x00\\x98\\xab\\x7f\\xa5" } ], "repeated": 0, "id": 911 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xa9\\x7f\\xa5\\x98\\x00\\x00\\x00p\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 912 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 913 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 914 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xed\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x84\\x03\\x00\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xaf\\x96U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00" } ], "repeated": 0, "id": 915 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 916 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18E\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 917 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 918 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 919 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\xb3\\xb4\\x11\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x10\\xa8\\x7f\\xa5\\x98\\x00\\x00\\x00\\x08\\xa8\\x7f\\xa5\\x98\\x00\\x00\\x00\\xd8\\xa7\\x7f\\xa5\\x98\\x00\\x00\\x00\\xf8\\xa7\\x7f\\xa5" } ], "repeated": 0, "id": 920 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xa5\\x7f\\xa5\\x98\\x00\\x00\\x00p\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 921 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255972000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 922 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 923 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000370" } ], "repeated": 0, "id": 924 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8436", "caller": "0x7fff577d54eb", "parentcaller": "0x7fff584c8ce0", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "\\x83&\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00k\\xd3\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 925 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8436", "caller": "0x7fff577d6785", "parentcaller": "0x7fff584c8c8a", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000378" } ], "repeated": 0, "id": 926 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fc507d", "parentcaller": "0x7fff59fc4c43", "category": "threading", "api": "NtTestAlert", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 927 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x00000000", "parentcaller": "0x00000000", "category": "threading", "api": "RtlUserThreadStart", "status": true, "return": "0x00000000", "arguments": [ { "name": "StartAddress", "value": "0x7fff59fa2b30" }, { "name": "Parameter", "value": "0x1a255900b50" } ], "repeated": 0, "id": 928 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff57806f4c", "parentcaller": "0x7fff5978ef53", "category": "system", "api": "NtDuplicateObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "SourceProcessHandle", "value": "0xffffffff" }, { "name": "SourceHandle", "value": "0xfffffffe" }, { "name": "TargetProcessHandle", "value": "0xffffffff" }, { "name": "TargetHandle", "value": "0x00000380" }, { "name": "Options", "value": "0x00000002" } ], "repeated": 0, "id": 929 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255975000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 930 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{0000000C-0000-0000-C000-000000000046}" }, { "name": "Handle", "value": "0x00000386" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0000000C-0000-0000-C000-000000000046}" } ], "repeated": 0, "id": 931 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x00000386" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x0000038a" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32" } ], "repeated": 0, "id": 932 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038a" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{00000320-0000-0000-C000-000000000046}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 933 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038a" } ], "repeated": 0, "id": 934 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" } ], "repeated": 0, "id": 935 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255976000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 936 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 937 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x00000384" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 938 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000388" } ], "repeated": 0, "id": 939 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 940 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "x\\xf1\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 941 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\xe0\\xf1\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xba\\xbe7I\\x83\\x19\\xb5\\xdb\\xef\\x9c\\xcc6\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 942 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 943 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "(D\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 944 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 945 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 946 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00c\\x90\\xe9\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xc0\\xc3\\x87\\xa5\\x98\\x00\\x00\\x00\\xb8\\xc3\\x87\\xa5\\x98\\x00\\x00\\x00\\x88\\xc3\\x87\\xa5\\x98\\x00\\x00\\x00\\xa8\\xc3\\x87\\xa5" } ], "repeated": 0, "id": 947 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xc1\\x87\\xa5\\x98\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 948 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 949 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xed\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05" } ], "repeated": 0, "id": 950 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "`\\xf6\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 951 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 952 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18E\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 953 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 954 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xf6\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 955 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00\\x83\\x9c\\xe9\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00 \\xc0\\x87\\xa5\\x98\\x00\\x00\\x00\\x18\\xc0\\x87\\xa5\\x98\\x00\\x00\\x00\\xe8\\xbf\\x87\\xa5\\x98\\x00\\x00\\x00\\x08\\xc0\\x87\\xa5" } ], "repeated": 0, "id": 956 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf6\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x08\\xbe\\x87\\xa5\\x98\\x00\\x00\\x00\\x88\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 957 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000384" } ], "repeated": 0, "id": 958 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000388" } ], "repeated": 0, "id": 959 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fc1963", "parentcaller": "0x7fff59fc1798", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255a02000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 960 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 961 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 962 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 963 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 964 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255979000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 965 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25597a000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 966 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff585192b9", "parentcaller": "0x7fff5855224d", "category": "com", "api": "CoCreateInstance", "status": true, "return": "0x00000000", "arguments": [ { "name": "rclsid", "value": "00000339-0000-0000-C000-000000000046" }, { "name": "ClsContext", "value": "0x00000403", "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD" }, { "name": "riid", "value": "00000003-0000-0000-C000-000000000046" }, { "name": "ProgID", "value": "" } ], "repeated": 0, "id": 967 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}" }, { "name": "Handle", "value": "0x0000038a" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}" } ], "repeated": 0, "id": 968 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000038a" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000386" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32" } ], "repeated": 0, "id": 969 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 970 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000386" } ], "repeated": 0, "id": 971 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038a" } ], "repeated": 0, "id": 972 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 973 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 974 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f5e715", "parentcaller": "0x7fff59f5e37b", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25597b000" }, { "name": "RegionSize", "value": "0x00011000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 975 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff584d22bf", "parentcaller": "0x7fff5854fbe4", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000026e" }, { "name": "SubKey", "value": "Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}" }, { "name": "Handle", "value": "0x0000038e" }, { "name": "FullName", "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}" } ], "repeated": 0, "id": 976 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fa51", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegOpenKeyExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Registry", "value": "0x0000038e" }, { "name": "SubKey", "value": "ProxyStubClsid32" }, { "name": "Handle", "value": "0x00000392" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32" } ], "repeated": 0, "id": 977 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fa8c", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegQueryValueExW", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000392" }, { "name": "ValueName", "value": "" }, { "name": "Data", "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)" } ], "repeated": 0, "id": 978 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fad3", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000392" } ], "repeated": 0, "id": 979 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5854fae4", "parentcaller": "0x7fff585142ab", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038e" } ], "repeated": 0, "id": 980 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 981 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577c30ce", "parentcaller": "0x7fff58552cd1", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000260" }, { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 982 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f93f7a", "parentcaller": "0x7fff59770ed7", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "29" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 983 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59770cd1", "parentcaller": "0x7fff5976f28f", "category": "filesystem", "api": "NtOpenDirectoryObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "DirectoryHandle", "value": "0x0000038c" }, { "name": "DesiredAccess", "value": "0x00020001", "pretty_value": "FILE_READ_ACCESS|READ_CONTROL" }, { "name": "ObjectAttributes", "value": "C:\\RPC Control" } ], "repeated": 0, "id": 984 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff5781026b", "parentcaller": "0x7fff59770daf", "category": "process", "api": "NtOpenProcessToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "DesiredAccess", "value": "0x00000008" }, { "name": "TokenHandle", "value": "0x00000390" } ], "repeated": 0, "id": 985 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59fc9c4e", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 986 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xb8\\xf3\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb8\\x11nX\\xff\\x7f\\x00\\x00\\x90\\x11nX\\xff\\x7f\\x00\\x00X\\x11nX\\xff\\x7f\\x00\\x00\\xb0\\xda\\x96U\\xa2\\x01\\x00\\x000\\xaa\\x93U\\xa2\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xdd~\\x1e\\xde" } ], "repeated": 0, "id": 987 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": "\\x80\\xf1\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00`\\x87\\xc0Z\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf7\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 988 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 989 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\xf8F\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 990 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 991 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\xb8\\xf6\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 992 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x003\\xec\\xe9\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\x90\\xcf\\x87\\xa5\\x98\\x00\\x00\\x00\\x88\\xcf\\x87\\xa5\\x98\\x00\\x00\\x00X\\xcf\\x87\\xa5\\x98\\x00\\x00\\x00x\\xcf\\x87\\xa5" } ], "repeated": 0, "id": 993 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xf6\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xcd\\x87\\xa5\\x98\\x00\\x00\\x00\\x90\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 994 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59f88cde", "parentcaller": "0x7fff59f8953a", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "10" }, { "name": "TokenInformation", "value": "C\\x1d\\x10\\x00\\x00\\x00\\x00\\x00\\x1b\\x8d\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00u\\x8d\\x02\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 995 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e46", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "4" }, { "name": "TokenInformation", "value": "\\xf8\\xf5\\x95U\\xa2\\x01\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb8\\x11nX\\xff\\x7f\\x00\\x00\\x90\\x11nX\\xff\\x7f\\x00\\x00X\\x11nX\\xff\\x7f\\x00\\x00\\xd0\\x13\\x97U\\xa2\\x01\\x00\\x000\\xaa\\x93U\\xa2\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xdd~\\x1e\\xde" } ], "repeated": 0, "id": 996 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6e9b", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "25" }, { "name": "TokenInformation", "value": " \\xfa\\x95U\\xa2\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } ], "repeated": 0, "id": 997 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6ec0", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 998 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f0e", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "5" }, { "name": "TokenInformation", "value": "\\x18E\\x96U\\xa2\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00" } ], "repeated": 0, "id": 999 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f37", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": false, "return": "0xffffffffc0000023", "pretty_return": "BUFFER_TOO_SMALL", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "" } ], "repeated": 0, "id": 1000 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb6f8f", "parentcaller": "0x7fff59f88d8f", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "6" }, { "name": "TokenInformation", "value": "\\x18\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x8b\\x02\\x00" } ], "repeated": 0, "id": 1001 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb7048", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\xdf\\x17\\xff\\x7f\\x00\\x00\\xebP\\xb7\\x17\\xff\\x7f\\x00\\x00S\\xe8\\xe9\\x82\\x107\\x00\\x00(N\\xdb\\x17\\xff\\x7f\\x00\\x00\\xf0\\xcb\\x87\\xa5\\x98\\x00\\x00\\x00\\xe8\\xcb\\x87\\xa5\\x98\\x00\\x00\\x00\\xb8\\xcb\\x87\\xa5\\x98\\x00\\x00\\x00\\xd8\\xcb\\x87\\xa5" } ], "repeated": 0, "id": 1002 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff59fb707b", "parentcaller": "0x7fff59fb6fa8", "category": "process", "api": "NtQueryInformationToken", "status": true, "return": "0x00000000", "arguments": [ { "name": "TokenInformationClass", "value": "41" }, { "name": "TokenInformation", "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x95U\\xa2\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xb8\\x17\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xc9\\x87\\xa5\\x98\\x00\\x00\\x00\\x90\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\x17\\x1a\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\xdb\\x17" } ], "repeated": 0, "id": 1003 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e27", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000038c" } ], "repeated": 0, "id": 1004 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "1552", "caller": "0x7fff577d6785", "parentcaller": "0x7fff59770e49", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000390" } ], "repeated": 0, "id": 1005 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b836a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000314" } ], "repeated": 0, "id": 1006 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b6b295", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000318" } ], "repeated": 0, "id": 1007 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff577d6785", "parentcaller": "0x7fff52b836a9", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000310" } ], "repeated": 0, "id": 1008 }, { "timestamp": "2026-05-29 01:20:01,464", "thread_id": "8140", "caller": "0x7fff59fa0444", "parentcaller": "0x1a258bbc307", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e8" } ], "repeated": 0, "id": 1009 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1010 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "8140", "caller": "0x7fff577ce76a", "parentcaller": "0x7fff584cea0e", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 1011 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "8140", "caller": "0x7fff59f97830", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1012 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "8140", "caller": "0x7fff59f97881", "parentcaller": "0x7fff59f820f9", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff587d1000" }, { "name": "ModuleName", "value": "combase.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1013 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f8" } ], "repeated": 0, "id": 1014 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000023c" } ], "repeated": 0, "id": 1015 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000244" } ], "repeated": 0, "id": 1016 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000022c" } ], "repeated": 0, "id": 1017 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000280" } ], "repeated": 0, "id": 1018 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000288" } ], "repeated": 0, "id": 1019 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtDelayExecution", "status": true, "return": "0x00000000", "arguments": [ { "name": "Milliseconds", "value": "0" } ], "repeated": 0, "id": 1020 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "8140", "caller": "0x7fff597abf07", "parentcaller": "0x7fff597abe66", "category": "system", "api": "GetSystemTimeAsFileTime", "status": true, "return": "0x00000000", "arguments": [], "repeated": 0, "id": 1021 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25592f000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1022 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255988000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1023 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25593b000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1024 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255950000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1025 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "8140", "caller": "0x7fff59765bc1", "parentcaller": "0x7fff59765b34", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002ac" } ], "repeated": 0, "id": 1026 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a2572e0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1027 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000248" } ], "repeated": 0, "id": 1028 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000024e" } ], "repeated": 0, "id": 1029 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a255950000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1030 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000035c" } ], "repeated": 0, "id": 1031 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000358" } ], "repeated": 0, "id": 1032 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000354" } ], "repeated": 0, "id": 1033 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000328" } ], "repeated": 0, "id": 1034 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000324" } ], "repeated": 0, "id": 1035 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnregisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fceec0" } ], "repeated": 0, "id": 1036 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnsubscribeWnfNotificationWaitForCompletion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb2650" } ], "repeated": 0, "id": 1037 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1038 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" } ], "repeated": 0, "id": 1039 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\wpnapps" }, { "name": "DllBase", "value": "0x7fff40fb0000" } ], "repeated": 0, "id": 1040 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000320" } ], "repeated": 0, "id": 1041 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1042 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1043 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\shcore" }, { "name": "DllBase", "value": "0x7fff58070000" } ], "repeated": 0, "id": 1044 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff58070000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1045 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000032c" } ], "repeated": 0, "id": 1046 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000330" } ], "repeated": 0, "id": 1047 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1048 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1049 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\wintypes" }, { "name": "DllBase", "value": "0x7fff52dc0000" } ], "repeated": 0, "id": 1050 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52dc0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1051 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000334" } ], "repeated": 0, "id": 1052 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\RMCLIENT" }, { "name": "DllBase", "value": "0x7fff55410000" } ], "repeated": 0, "id": 1053 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff55410000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1054 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\XmlLite" }, { "name": "DllBase", "value": "0x7fff523e0000" } ], "repeated": 0, "id": 1055 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff523e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1056 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000350" } ], "repeated": 0, "id": 1057 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000034c" } ], "repeated": 0, "id": 1058 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000348" } ], "repeated": 0, "id": 1059 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000338" } ], "repeated": 0, "id": 1060 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000033c" } ], "repeated": 0, "id": 1061 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000340" } ], "repeated": 0, "id": 1062 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000344" } ], "repeated": 0, "id": 1063 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1064 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1065 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\twinapi.appcore" }, { "name": "DllBase", "value": "0x7fff517c0000" } ], "repeated": 0, "id": 1066 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff517c0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1067 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\usermgrcli" }, { "name": "DllBase", "value": "0x7fff52490000" } ], "repeated": 0, "id": 1068 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52490000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1069 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff40fb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1070 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b4" } ], "repeated": 0, "id": 1071 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnregisterFeatureConfigurationChangeNotification" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fceec0" } ], "repeated": 0, "id": 1072 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlUnsubscribeWnfNotificationWaitForCompletion" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb2650" } ], "repeated": 0, "id": 1073 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1074 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000048" } ], "repeated": 0, "id": 1075 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthAgent" }, { "name": "DllBase", "value": "0x1a258bb0000" } ], "repeated": 0, "id": 1076 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258da0000" }, { "name": "RegionSize", "value": "0x00007000" } ], "repeated": 0, "id": 1077 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000031c" } ], "repeated": 0, "id": 1078 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c4" } ], "repeated": 0, "id": 1079 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c0" } ], "repeated": 0, "id": 1080 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1081 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1082 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\Wldp" }, { "name": "DllBase", "value": "0x7fff56fa0000" } ], "repeated": 0, "id": 1083 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56fa0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1084 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002c8" } ], "repeated": 0, "id": 1085 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002cc" } ], "repeated": 0, "id": 1086 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d0" } ], "repeated": 0, "id": 1087 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d4" } ], "repeated": 0, "id": 1088 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002d8" } ], "repeated": 0, "id": 1089 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002dc" } ], "repeated": 0, "id": 1090 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e0" } ], "repeated": 0, "id": 1091 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002e4" } ], "repeated": 0, "id": 1092 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\SYSTEM32\\ntmarta" }, { "name": "DllBase", "value": "0x7fff56770000" } ], "repeated": 0, "id": 1093 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff56770000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1094 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258bb0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1095 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\system32\\SecurityHealthProxyStub" }, { "name": "DllBase", "value": "0x7fff4c1e0000" } ], "repeated": 0, "id": 1096 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff4c1e0000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1097 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff3fd40000" } ], "repeated": 0, "id": 1098 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff3fd40000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1099 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub" }, { "name": "DllBase", "value": "0x7fff50870000" } ], "repeated": 0, "id": 1100 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff50870000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1101 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de3000" }, { "name": "RegionSize", "value": "0x00012000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1102 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de2000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1103 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1104 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dde000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1105 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dde000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1106 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ddc000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1107 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dcb000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1108 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1109 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1110 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ddc000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1111 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258de2000" }, { "name": "RegionSize", "value": "0x00013000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1112 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258ddc000" }, { "name": "RegionSize", "value": "0x00019000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1113 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1114 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dcb000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1115 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dcb000" }, { "name": "RegionSize", "value": "0x00003000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1116 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "FreeType", "value": "0x00004000" } ], "repeated": 0, "id": 1117 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd7000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1118 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a257470000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1119 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc3000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1120 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc5000" }, { "name": "RegionSize", "value": "0x00002000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1121 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002f4" } ], "repeated": 0, "id": 1122 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000308" } ], "repeated": 0, "id": 1123 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1124 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1125 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258d60000" }, { "name": "RegionSize", "value": "0x00032000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1126 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dd0000" }, { "name": "RegionSize", "value": "0x00100000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1127 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtFreeVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a258dc0000" }, { "name": "RegionSize", "value": "0x00010000" }, { "name": "FreeType", "value": "0x00008000" } ], "repeated": 0, "id": 1128 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000304" } ], "repeated": 0, "id": 1129 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "DllLoadNotification", "status": true, "return": "0x00000000", "arguments": [ { "name": "NotificationReason", "value": "unload" }, { "name": "DllName", "value": "C:\\Windows\\System32\\msxml6" }, { "name": "DllBase", "value": "0x7fff52b60000" } ], "repeated": 0, "id": 1130 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "process", "api": "NtUnmapViewOfSection", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff52b60000" }, { "name": "RegionSize", "value": "0x00001000" } ], "repeated": 0, "id": 1131 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c0719b5", "parentcaller": "0x7ff71c071c99", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "oleaut32.dll" }, { "name": "ModuleHandle", "value": "0x7fff58860000" } ], "repeated": 0, "id": 1132 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c071cee", "parentcaller": "0x7ff71c07d52c", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000234" } ], "repeated": 0, "id": 1133 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c074b1b", "parentcaller": "0x7ff71c07ee4f", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1134 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c078d39", "parentcaller": "0x7ff71c07ed95", "category": "system", "api": "NtWaitForSingleObject", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" }, { "name": "Milliseconds", "value": "18446744073709551615" }, { "name": "Status", "value": "Infinite" } ], "repeated": 0, "id": 1135 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07523f", "parentcaller": "0x7ff71c078e5e", "category": "synchronization", "api": "NtReleaseMutant", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000210" } ], "repeated": 0, "id": 1136 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07ed67", "parentcaller": "0x7ff71c07d593", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000204" } ], "repeated": 0, "id": 1137 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrLoadDll", "status": true, "return": "0x00000000", "arguments": [ { "name": "Flags", "value": "0x00000000" }, { "name": "FileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "BaseAddress", "value": "0x7fff55510000" } ], "repeated": 0, "id": 1138 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LoadLibraryExW", "status": true, "return": "0x7fff55510000", "arguments": [ { "name": "lpLibFileName", "value": "api-ms-win-appmodel-runtime-l1-1-2" }, { "name": "dwFlags", "value": "0x00000800" } ], "repeated": 0, "id": 1139 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "kernel.appcore.dll" }, { "name": "ModuleHandle", "value": "0x7fff55510000" }, { "name": "FunctionName", "value": "AppPolicyGetProcessTerminationMethod" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff555130e0" } ], "repeated": 0, "id": 1140 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": false, "return": "0xffffffffc0000135", "pretty_return": "DLL_NOT_FOUND", "arguments": [ { "name": "FileName", "value": "mscoree.dll" }, { "name": "ModuleHandle", "value": "0x7fff57d1d3a0" } ], "repeated": 0, "id": 1141 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0x00000000" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1142 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000250" } ], "repeated": 0, "id": 1143 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtUnmapViewOfSectionEx", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a2572f0000" }, { "name": "RegionSize", "value": "0x00001000" }, { "name": "Flags", "value": "0" } ], "repeated": 0, "id": 1144 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000025c" } ], "repeated": 0, "id": 1145 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtAllocateVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x1a25592f000" }, { "name": "RegionSize", "value": "0x00004000" }, { "name": "Protection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1146 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000240" } ], "repeated": 0, "id": 1147 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000238" } ], "repeated": 0, "id": 1148 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000230" } ], "repeated": 0, "id": 1149 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000021c" } ], "repeated": 0, "id": 1150 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1151 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1152 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001bc" } ], "repeated": 0, "id": 1153 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001c0" } ], "repeated": 0, "id": 1154 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001b8" } ], "repeated": 0, "id": 1155 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001ac" } ], "repeated": 0, "id": 1156 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000018c" } ], "repeated": 0, "id": 1157 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000190" } ], "repeated": 0, "id": 1158 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000188" } ], "repeated": 0, "id": 1159 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000170" } ], "repeated": 0, "id": 1160 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000174" } ], "repeated": 0, "id": 1161 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000178" } ], "repeated": 0, "id": 1162 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000017c" } ], "repeated": 0, "id": 1163 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000180" } ], "repeated": 0, "id": 1164 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000184" } ], "repeated": 0, "id": 1165 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "OldAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1166 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtProtectVirtualMemory", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "BaseAddress", "value": "0x7fff59441000" }, { "name": "ModuleName", "value": "ole32.dll" }, { "name": "NumberOfBytesProtected", "value": "0x00001000" }, { "name": "MemoryType", "value": "0x00000000" }, { "name": "NewAccessProtection", "value": "0x00000002", "pretty_value": "PAGE_READONLY" }, { "name": "OldAccessProtection", "value": "0x00000004", "pretty_value": "PAGE_READWRITE" }, { "name": "StackPivoted", "value": "no" } ], "repeated": 0, "id": 1167 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000168" } ], "repeated": 0, "id": 1168 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000016c" } ], "repeated": 0, "id": 1169 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000164" } ], "repeated": 0, "id": 1170 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1171 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1172 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002b0" } ], "repeated": 0, "id": 1173 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000148" } ], "repeated": 0, "id": 1174 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000014c" } ], "repeated": 0, "id": 1175 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000150" } ], "repeated": 0, "id": 1176 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000154" } ], "repeated": 0, "id": 1177 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000158" } ], "repeated": 0, "id": 1178 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000160" } ], "repeated": 0, "id": 1179 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000015c" } ], "repeated": 0, "id": 1180 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000128" } ], "repeated": 0, "id": 1181 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000012c" } ], "repeated": 0, "id": 1182 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000124" } ], "repeated": 0, "id": 1183 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000268" } ], "repeated": 0, "id": 1184 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000120" } ], "repeated": 0, "id": 1185 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000118" } ], "repeated": 0, "id": 1186 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000011c" } ], "repeated": 0, "id": 1187 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000114" } ], "repeated": 0, "id": 1188 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000110" } ], "repeated": 0, "id": 1189 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000010c" } ], "repeated": 0, "id": 1190 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000300" } ], "repeated": 0, "id": 1191 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "RegCloseKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000002fc" } ], "repeated": 0, "id": 1192 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000100" } ], "repeated": 0, "id": 1193 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e8" } ], "repeated": 0, "id": 1194 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000ec" } ], "repeated": 0, "id": 1195 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f0" } ], "repeated": 0, "id": 1196 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f4" } ], "repeated": 0, "id": 1197 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000f8" } ], "repeated": 0, "id": 1198 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000fc" } ], "repeated": 0, "id": 1199 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000108" } ], "repeated": 0, "id": 1200 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000104" } ], "repeated": 0, "id": 1201 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e4" } ], "repeated": 0, "id": 1202 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000dc" } ], "repeated": 0, "id": 1203 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000e0" } ], "repeated": 0, "id": 1204 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000c8" } ], "repeated": 0, "id": 1205 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000cc" } ], "repeated": 0, "id": 1206 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a8" } ], "repeated": 0, "id": 1207 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a4" } ], "repeated": 0, "id": 1208 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 1209 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1210 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a0" }, { "name": "ValueName", "value": "DisableMetaFiles" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles" } ], "repeated": 0, "id": 1211 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 1212 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "NtOpenKey", "status": true, "return": "0x00000000", "arguments": [ { "name": "KeyHandle", "value": "0x000000a0" }, { "name": "DesiredAccess", "value": "0x00020019", "pretty_value": "KEY_READ" }, { "name": "ObjectAttributesHandle", "value": "0x00000000" }, { "name": "ObjectAttributesName", "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" }, { "name": "ObjectAttributes", "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize" } ], "repeated": 0, "id": 1213 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "registry", "api": "NtQueryValueKey", "status": false, "return": "0xffffffffc0000034", "pretty_return": "OBJECT_NAME_NOT_FOUND", "arguments": [ { "name": "KeyHandle", "value": "0x000000a0" }, { "name": "ValueName", "value": "DisableUmpdBufferSizeCheck" }, { "name": "FullName", "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" } ], "repeated": 0, "id": 1214 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000000a0" } ], "repeated": 0, "id": 1215 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1216 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000094" } ], "repeated": 0, "id": 1217 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000090" } ], "repeated": 0, "id": 1218 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000008c" } ], "repeated": 0, "id": 1219 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1220 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x000001cc" } ], "repeated": 0, "id": 1221 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000084" } ], "repeated": 0, "id": 1222 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetDllHandle", "status": true, "return": "0x00000000", "arguments": [ { "name": "FileName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" } ], "repeated": 0, "id": 1223 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "LdrGetProcedureAddressForCaller", "status": true, "return": "0x00000000", "arguments": [ { "name": "ModuleName", "value": "ntdll.dll" }, { "name": "ModuleHandle", "value": "0x7fff59f50000" }, { "name": "FunctionName", "value": "RtlDllShutdownInProgress" }, { "name": "Ordinal", "value": "0" }, { "name": "FunctionAddress", "value": "0x7fff59fb3410" } ], "repeated": 0, "id": 1224 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000064" } ], "repeated": 0, "id": 1225 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000044" } ], "repeated": 0, "id": 1226 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x0000005c" } ], "repeated": 0, "id": 1227 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "system", "api": "NtClose", "status": true, "return": "0x00000000", "arguments": [ { "name": "Handle", "value": "0x00000060" } ], "repeated": 0, "id": 1228 }, { "timestamp": "2026-05-29 01:20:01,480", "thread_id": "6740", "caller": "0x7ff71c07d593", "parentcaller": "0x00000000", "category": "process", "api": "NtTerminateProcess", "status": true, "return": "0x00000000", "arguments": [ { "name": "ProcessHandle", "value": "0xffffffff" }, { "name": "ExitCode", "value": "0x00000000" } ], "repeated": 0, "id": 1229 } ], "threads": [ "6740", "6760", "6692", "7024", "8424", "8336", "8436", "8140", "1552" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff71c070000", "MainExeSize": "0x0001a000", "Bitness": "64-bit" }, "file_activities": { "read_files": [], "write_files": [], "delete_files": [] } } ], "anomaly": [], "processtree": [ { "name": "msedge.exe", "pid": 4132, "parent_id": 4484, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", "children": [ { "name": "identity_helper.exe", "pid": 8972, "parent_id": 4132, "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe", "children": [], "threads": [ "8608", "8828", "8796", "8808", "672", "3980", "1772", "1360", "1304", "6020", "6016", "9072", "6780", "3272", "9144", "8072", "9148", "820", "8784", "4004", "7352", "6500" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7da540000", "MainExeSize": "0x0028c000", "Bitness": "64-bit" } } ], "threads": [ "2012", "5592", "5708", "3388", "6220", "5876", "7272", "5992", "5852", "5348", "5776", "5924", "5560", "8468", "3984", "8868", "7780", "400", "5212", "6032", "8792", "4952", "6024", "3092", "6480", "5860", "8940" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7f5380000", "MainExeSize": "0x00505000", "Bitness": "64-bit" } }, { "name": "svchost.exe", "pid": 832, "parent_id": 676, "module_path": "C:\\Windows\\System32\\svchost.exe", "children": [ { "name": "SecurityHealthHost.exe", "pid": 5232, "parent_id": 832, "module_path": "C:\\Windows\\System32\\SecurityHealthHost.exe", "children": [], "threads": [ "6740", "6760", "6692", "7024", "8424", "8336", "8436", "8140", "1552" ], "environ": { "UserName": "admin", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "CommandLine": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff71c070000", "MainExeSize": "0x0001a000", "Bitness": "64-bit" } } ], "threads": [ "1640", "780", "3476", "1064", "9164", "1652", "9132", "928", "3408", "464" ], "environ": { "UserName": "SYSTEM", "ComputerName": "DESKTOP-74SUV8W", "WindowsPath": "C:\\Windows", "TempPath": "C:\\Windows\\TEMP\\", "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p", "RegisteredOwner": "", "RegisteredOrganization": "", "ProductName": "", "SystemVolumeSerialNumber": "b34c-3674", "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000", "MachineGUID": "", "MainExeBase": "0x7ff7bf220000", "MainExeSize": "0x00010000", "Bitness": "64-bit" } } ], "summary": { "files": [ "C:\\Windows\\System32\\usp10.dll", "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls", "\\??\\pipe\\crashpad_4132_SQIGFBBJLBUYERTE", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak", "C:\\Windows\\System32\\kernel.appcore.dll", "C:\\Windows\\System32\\policymanager.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll", "C:\\Windows\\System32\\msvcp110_win.dll", "C:\\Windows\\System32\\usermgrcli.dll", "C:\\Windows\\System32\\capauthz.dll", "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll", "C:\\Windows\\System32\\msasn1.dll", "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui", "C:\\Windows\\SysWOW64\\propsys.dll", "C:\\Windows\\System32\\propsys.dll", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\", "C:\\Users\\admin\\AppData\\Local\\Packages", "C:\\Users\\admin\\AppData\\Local\\Packages\\", "C:\\Users\\admin\\AppData\\Local", "C:\\Users\\admin\\AppData\\Local\\", "C:\\Users\\admin\\AppData", "C:\\Users\\admin\\AppData\\", "C:\\Users\\admin", "C:\\Users\\admin\\", "C:\\Users", "C:\\Users\\", "C:", "\\??\\MountPointManager", "\\Device\\DeviceApi\\CMApi", "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*", "\\??\\PhysicalDrive0", "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep", "C:\\Windows\\System32\\SecurityHealthHost.exe", "C:\\Windows\\System32\\MsMpLics.dll", "\\Device\\CNG" ], "read_files": [], "write_files": [ "\\??\\pipe\\crashpad_4132_SQIGFBBJLBUYERTE" ], "delete_files": [], "keys": [ "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis", "HKEY_CURRENT_USER\\Software\\Classes", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\identity_helper.exe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_USERS", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager", "HKEY_CLASSES_ROOT\\Directory", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\Folder", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler", "HKEY_CLASSES_ROOT\\AllFilesystemObjects", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler", "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions", "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration", "HKEY_CLASSES_ROOT\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InprocHandler", "HKEY_LOCAL_MACHINE\\Software\\Classes\\Unmarshalers\\System\\{00000338-0000-0000-C000-000000000046}", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\TreatAs", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\Elevation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\CustomAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer32", "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0000000C-0000-0000-C000-000000000046}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "read_keys": [ "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck" ], "write_keys": [], "delete_keys": [], "executed_commands": [ "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff17a95d58,0x7fff17a95d64,0x7fff17a95d70", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2452,i,15093159467427093542,9469911486581750728,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2600 /prefetch:3", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2140,i,13971268289555839105,5024170361431510807,262144 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2292 /prefetch:2", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2772,i,7301802344932445960,9908392774046128039,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2752 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185280180 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3588,i,352751729640999831,7241083857455090681,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2824 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185281736 --skip-read-main-dll --metrics-shmem-handle=3668,i,13641473871044752765,1587090757937272952,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2508 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4968,i,2703826968512009090,10212290371382479832,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5220 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5188,i,13859723405859082630,9305877728756642692,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5288 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=213130873 --skip-read-main-dll --metrics-shmem-handle=6248,i,3255421910467508928,14061151991070598029,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5676 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=214159338 --skip-read-main-dll --metrics-shmem-handle=6524,i,11924266036566698167,15539547891894405667,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4680 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6196,i,6479037369313746977,9159291806258192882,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4012 /prefetch:8", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=240536740 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6276,i,6845367754590566645,7399985378762200423,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5148 /prefetch:1", "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3960,i,10386633558955450950,13100030651159545818,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=1732 /prefetch:8", "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding", "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca" ], "resolved_apis": [], "mutexes": [ "Local\\SM0:8972:304:WilStaging_02", "Local\\SM0:8972:120:WilError_03", "Local\\SM0:5232:120:WilError_03", "Local\\SM0:5232:304:WilStaging_02" ], "created_services": [], "started_services": [] }, "enhanced": [ { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,695", "eid": 1, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff17a95d58,0x7fff17a95d64,0x7fff17a95d70" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,788", "eid": 2, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2452,i,15093159467427093542,9469911486581750728,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2600 /prefetch:3" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,788", "eid": 3, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2140,i,13971268289555839105,5024170361431510807,262144 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2292 /prefetch:2" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,804", "eid": 4, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2772,i,7301802344932445960,9908392774046128039,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2752 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,882", "eid": 5, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185280180 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3588,i,352751729640999831,7241083857455090681,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2824 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:01,882", "eid": 6, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=185281736 --skip-read-main-dll --metrics-shmem-handle=3668,i,13641473871044752765,1587090757937272952,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2508 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:06,898", "eid": 7, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4968,i,2703826968512009090,10212290371382479832,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5220 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:06,898", "eid": 8, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5188,i,13859723405859082630,9305877728756642692,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5288 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:07,460", "eid": 9, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5928 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:29,726", "eid": 10, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=213130873 --skip-read-main-dll --metrics-shmem-handle=6248,i,3255421910467508928,14061151991070598029,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5676 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:30,757", "eid": 11, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=214159338 --skip-read-main-dll --metrics-shmem-handle=6524,i,11924266036566698167,15539547891894405667,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4680 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:31,773", "eid": 12, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6196,i,6479037369313746977,9159291806258192882,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4012 /prefetch:8" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:57,132", "eid": 13, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780017356603362 --launch-time-ticks=240536740 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6276,i,6845367754590566645,7399985378762200423,2097152 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5148 /prefetch:1" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:20:01,820", "eid": 14, "data": { "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=3960,i,10386633558955450950,13100030651159545818,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238370,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=1732 /prefetch:8" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,806", "eid": 15, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,806", "eid": 16, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,806", "eid": 17, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,806", "eid": 18, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 19, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 20, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 21, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 22, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 23, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 24, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 25, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 26, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 27, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 28, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 29, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 30, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 31, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 32, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 33, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 34, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel", "content": "stable" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 35, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 36, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 37, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name", "content": "" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 38, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 39, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 40, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx", "content": "kernel32.dll" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 41, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 42, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 43, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,822", "eid": 44, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 45, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,822", "eid": 46, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,837", "eid": 47, "data": { "file": "api-ms-win-core-file-l1-2-1.dll", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,837", "eid": 48, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 49, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 50, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 51, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 52, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 53, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 54, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 55, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 56, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 57, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 58, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 59, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 60, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 61, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 62, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 63, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 64, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,947", "eid": 65, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 66, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff58070000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 67, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 68, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 69, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 70, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 71, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,947", "eid": 72, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 73, "data": { "file": "api-ms-win-core-fibers-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 74, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 75, "data": { "file": "api-ms-win-core-localization-l1-2-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 76, "data": { "file": "kernel32", "pathtofile": null, "moduleaddress": "0x7fff57fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 77, "data": { "file": "api-ms-win-core-string-l1-1-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 78, "data": { "file": "api-ms-win-core-datetime-l1-1-1", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 79, "data": { "file": "api-ms-win-core-localization-obsolete-l1-2-0", "pathtofile": null, "moduleaddress": "0x7fff577a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 80, "data": { "file": "bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,962", "eid": 81, "data": { "file": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll", "pathtofile": null, "moduleaddress": "0x24647000000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 82, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 83, "data": { "file": "ucrtbase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 84, "data": { "file": "ADVAPI32.dll", "pathtofile": null, "moduleaddress": "0x7fff599c0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 85, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 86, "data": { "file": "C:\\Windows\\System32\\uxtheme.dll", "pathtofile": null, "moduleaddress": "0x7fff54fc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 87, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 88, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 89, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 90, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 91, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 92, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 93, "data": { "file": "USER32.dll", "pathtofile": null, "moduleaddress": "0x7fff581b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 94, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 95, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 96, "data": { "file": "api-ms-win-core-wow64-l1-1-1.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 97, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR", "content": "3803" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:07,978", "eid": 98, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion", "content": "22H2" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 99, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,978", "eid": 100, "data": { "file": "Kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 101, "data": { "file": "kernel32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 102, "data": { "file": "shell32.dll", "pathtofile": null, "moduleaddress": "0x7fff58be0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 103, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 104, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 105, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 106, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 107, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 108, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 109, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 110, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 111, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 112, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 113, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 114, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 115, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 116, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 117, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 118, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 119, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 120, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 121, "data": { "file": "api-ms-win-core-winrt-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff584a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 122, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 123, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:07,994", "eid": 124, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 125, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 126, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 127, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:07,994", "eid": 128, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 129, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 130, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 131, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 132, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 133, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 134, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 135, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 136, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 137, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,009", "eid": 138, "data": { "file": "api-ms-win-core-winrt-string-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff584a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,009", "eid": 139, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 140, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 141, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,009", "eid": 142, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 144, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 145, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath", "content": "C:\\Windows\\System32\\execmodelclient.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 153, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 154, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,009", "eid": 155, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,009", "eid": 156, "data": { "file": "C:\\Windows\\System32\\execmodelclient.dll", "pathtofile": null, "moduleaddress": "0x7fff46d30000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,009", "eid": 157, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 158, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 159, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 160, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath", "content": "C:\\Windows\\System32\\combase.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 161, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 162, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 163, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 164, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 167, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 168, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 169, "data": { "file": "C:\\Windows\\System32\\combase.dll", "pathtofile": null, "moduleaddress": "0x7fff584a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 170, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 171, "data": { "file": "ole32.dll", "pathtofile": null, "moduleaddress": "0x7fff59330000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 172, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 173, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 174, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 175, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 176, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 177, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 178, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 179, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 180, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 181, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 182, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 183, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 184, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 185, "data": { "file": "C:\\Windows\\System32\\wpnapps.dll", "pathtofile": null, "moduleaddress": "0x7fff40fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 186, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 187, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 188, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 189, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 190, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 191, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 192, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 193, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,025", "eid": 194, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,025", "eid": 195, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 196, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 197, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,040", "eid": 198, "data": { "file": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff48780000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 199, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 200, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 201, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 202, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 203, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 204, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 205, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 206, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 207, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 208, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 209, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 210, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 211, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 212, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 213, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 214, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)", "content": "Windows Push Notification Developer Proxy Stub" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 215, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 216, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 217, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 218, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 219, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)", "content": "%systemroot%\\system32\\execmodelproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 220, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)", "content": "%SystemRoot%\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 221, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 222, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 223, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 224, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 225, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,040", "eid": 226, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 227, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 228, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 229, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 230, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 231, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 232, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 233, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 234, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 235, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 236, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 237, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 238, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 239, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 240, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 241, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 242, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 243, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 244, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 245, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 246, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 247, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 248, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 249, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 250, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 251, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 252, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 253, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 254, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 255, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 256, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 257, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": "Windows Push Notification Platform" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 258, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 259, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 260, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 261, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 262, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 263, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 264, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 265, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 266, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 267, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 268, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 269, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 270, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 271, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 272, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 273, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 274, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 275, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 276, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 277, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 278, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 279, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 280, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 281, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 282, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 283, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 284, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 285, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 286, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 287, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 288, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 289, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 290, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 291, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 292, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 293, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 294, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 295, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 296, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 297, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 298, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 299, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 300, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 301, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 302, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 303, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 304, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 305, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 306, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 307, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 308, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 309, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 310, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 311, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 312, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 313, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 314, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 315, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 316, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 317, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 318, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 319, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 320, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 321, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 322, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 323, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,056", "eid": 324, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,056", "eid": 325, "data": { "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff50870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,056", "eid": 326, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,056", "eid": 327, "data": { "file": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll", "pathtofile": null, "moduleaddress": "0x7fff4cbf0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,056", "eid": 328, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 329, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 330, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 331, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 332, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 333, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 334, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 335, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 336, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 337, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 338, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 339, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 340, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 341, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 342, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 343, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 344, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 345, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 346, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 347, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 348, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{679C64B7-81AB-42C2-8819-C958767753F4}\\ProxyStubClsid32\\(Default)", "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 349, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 350, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 351, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired" } }, { "event": "write", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 352, "data": { "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 353, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 354, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 355, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 356, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 357, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 358, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 359, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 360, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 361, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 362, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 363, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 364, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 365, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 366, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 367, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,072", "eid": 368, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_UserInControlOfTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 369, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 370, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 371, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 372, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 373, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 374, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 375, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 376, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 377, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 378, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 379, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 380, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 381, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 382, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 383, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 384, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceAllowTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 385, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 386, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 387, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 388, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior", "content": "139296" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 389, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 390, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 391, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 392, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 393, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname", "content": "LetAppsRunInBackground_ForceDenyTheseApps" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 394, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 395, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 396, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 397, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 398, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 399, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:08,087", "eid": 400, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 401, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 402, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 403, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 404, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 405, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 406, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath", "content": "C:\\Windows\\System32\\Windows.ApplicationModel.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 407, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname", "content": "LetAppsRunInBackground" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 408, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 409, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath", "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 410, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 411, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 412, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 413, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 414, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 415, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 416, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 417, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 418, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid", "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 419, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 420, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids", "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 421, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 422, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags", "content": "0" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 423, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": "0x7fff59f50000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 424, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 425, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 426, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 427, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 428, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 429, "data": { "file": "C:\\Windows\\System32\\Windows.ApplicationModel.dll", "pathtofile": null, "moduleaddress": "0x7fff457f0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 430, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 431, "data": { "file": "C:\\Windows\\System32\\bcryptprimitives.dll", "pathtofile": null, "moduleaddress": "0x7fff57ef0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 432, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 433, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 434, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 435, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)", "content": "04c19204-10d9-450a-95c4-2910c8f72be3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 436, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 437, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 438, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 439, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 440, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 441, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 442, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 443, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 444, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 445, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 446, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 447, "data": { "file": "C:\\Windows\\System32\\CryptoWinRT.dll", "pathtofile": null, "moduleaddress": "0x2465d490000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,087", "eid": 448, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 449, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 450, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 451, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 452, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 453, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 454, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 455, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 456, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 457, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 458, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 459, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 460, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 461, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 462, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath", "content": "C:\\Windows\\System32\\CryptoWinRT.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 463, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 464, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 465, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 466, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 467, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 468, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 469, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 470, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 471, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 472, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,087", "eid": 473, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 474, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath", "content": "C:\\Windows\\System32\\twinapi.appcore.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 475, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 476, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 477, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 478, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 479, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 480, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 481, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:08,103", "eid": 482, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:08,103", "eid": 483, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 484, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 485, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 486, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 487, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 488, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 489, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 490, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 491, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 492, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 493, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,150", "eid": 494, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,150", "eid": 495, "data": { "file": "C:\\Windows\\System32\\WinTypes.dll", "pathtofile": null, "moduleaddress": "0x7fff52dc0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,150", "eid": 496, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,165", "eid": 497, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,165", "eid": 498, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 499, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 500, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 501, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 502, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 503, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 504, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 505, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 506, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 507, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 508, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 509, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 510, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 511, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 512, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 513, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 514, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 515, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 516, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 517, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 518, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 519, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 520, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,181", "eid": 521, "data": { "file": "api-ms-win-downlevel-shell32-l1-1-0.dll", "pathtofile": null, "moduleaddress": "0x7fff58070000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,181", "eid": 522, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 523, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 524, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 525, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 526, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 527, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 528, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 529, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 530, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 531, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 532, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 533, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 534, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 535, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 536, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 537, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 538, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 539, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 540, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 541, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,181", "eid": 542, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,197", "eid": 543, "data": { "file": "C:\\Windows\\System32\\TileDataRepository.dll", "pathtofile": null, "moduleaddress": "0x7fff43150000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,197", "eid": 544, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,197", "eid": 545, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 546, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType", "content": "1" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,197", "eid": 547, "data": { "file": "C:\\Windows\\System32\\biwinrt.dll", "pathtofile": null, "moduleaddress": "0x7fff3d7b0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,197", "eid": 548, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 549, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 550, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 551, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 552, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 553, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions", "content": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 554, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 555, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 556, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 557, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 558, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 559, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 560, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 561, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 562, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 563, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath", "content": "C:\\Windows\\System32\\biwinrt.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 564, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity", "content": "nt authority\\system" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 565, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 566, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 567, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 568, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 569, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 570, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 571, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 572, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 573, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 574, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 575, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 576, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 577, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 578, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 579, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 580, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 581, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 582, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 583, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 584, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 585, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 586, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 587, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,197", "eid": 588, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": "Windows.System.User.ProxyStubFactory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 589, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 590, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 591, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 592, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 593, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 594, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 595, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\usermgrproxy.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 596, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 597, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 598, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 599, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 600, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 601, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 602, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 603, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 604, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 605, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 606, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 607, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 608, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 609, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 610, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 611, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 612, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 613, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 614, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 615, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 616, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath", "content": "C:\\Windows\\System32\\WinTypes.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 617, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 618, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 619, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 620, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 621, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 622, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 623, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 624, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 625, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 626, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 627, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 628, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 629, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 630, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 631, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 632, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 633, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 634, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 635, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 636, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 637, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 638, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 639, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 640, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 641, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 642, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,212", "eid": 643, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:10,212", "eid": 644, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,212", "eid": 645, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 646, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 647, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:10,212", "eid": 648, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 649, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 650, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 651, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 652, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 653, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 654, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 655, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 656, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 657, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 658, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 659, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 660, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:10,212", "eid": 661, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 662, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,212", "eid": 663, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 664, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,228", "eid": 665, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 666, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 667, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 668, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 669, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 670, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 671, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 672, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 673, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 674, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 675, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 676, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 677, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 678, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 679, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 680, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 681, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 682, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\windows.internal.shell.broker.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 683, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 684, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 685, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 686, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 687, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 688, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 689, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,228", "eid": 690, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,228", "eid": 691, "data": { "file": "gdi32.dll", "pathtofile": null, "moduleaddress": "0x7fff58350000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 692, "data": { "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll", "pathtofile": null, "moduleaddress": "0x7fff3d6a0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 693, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 694, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 695, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)", "content": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 696, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 697, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 698, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 699, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 700, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 701, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 702, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 703, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 704, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 705, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 706, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 707, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 708, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 709, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 710, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 711, "data": { "file": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff43060000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 712, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,244", "eid": 713, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 714, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 715, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 716, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 717, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 718, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 719, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 720, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 721, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 722, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 723, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 724, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 725, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 726, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server", "content": "UserManager" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 727, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 728, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,244", "eid": 729, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 730, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 731, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 732, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 733, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 734, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 735, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions", "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 736, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 737, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 738, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 739, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)", "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 740, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 741, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 742, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath", "content": "C:\\Windows\\System32\\TileDataRepository.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 743, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 744, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 745, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 746, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 747, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 748, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 749, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 750, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 751, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 752, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server", "content": "StateRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 753, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 754, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 755, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 756, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 757, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 758, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 759, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 760, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 761, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 762, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)", "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 763, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 764, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 765, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 766, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath", "content": "C:\\Windows\\System32\\StartTileData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 767, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 768, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 769, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 770, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 771, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 772, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 773, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,259", "eid": 774, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,275", "eid": 775, "data": { "file": "C:\\Windows\\System32\\StartTileData.dll", "pathtofile": null, "moduleaddress": "0x7fff43dd0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,275", "eid": 776, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 777, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,275", "eid": 778, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,275", "eid": 779, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 780, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 781, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 782, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\DllPath", "content": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 783, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 784, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 785, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 786, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 787, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 788, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 789, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 790, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,275", "eid": 791, "data": { "file": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll", "pathtofile": null, "moduleaddress": "0x7fff3d810000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,275", "eid": 792, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 793, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName", "content": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 794, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,275", "eid": 795, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 796, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 797, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 798, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 799, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,290", "eid": 800, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 801, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 802, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 803, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 804, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 805, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 806, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 807, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 808, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 809, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 810, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags", "content": "1581568" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 811, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 812, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 813, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,290", "eid": 814, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,290", "eid": 815, "data": { "file": "C:\\Windows\\System32\\mssprxy.dll", "pathtofile": null, "moduleaddress": "0x7fff4cd40000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,290", "eid": 816, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 817, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)", "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,306", "eid": 818, "data": { "file": "C:\\Windows\\System32\\propsys.dll", "pathtofile": null, "moduleaddress": "0x7fff52860000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,306", "eid": 819, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 820, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 821, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData", "content": "%USERPROFILE%\\AppData\\Local" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 822, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 823, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath", "content": "C:\\Users\\admin" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 824, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 825, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 826, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,306", "eid": 827, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot", "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,322", "eid": 828, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,322", "eid": 829, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,322", "eid": 830, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 831, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 832, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 833, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 834, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 835, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 836, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 837, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00t6L\\xb3\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 838, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 839, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 840, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 841, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 842, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data", "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 843, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 844, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 845, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 846, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 847, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 848, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 849, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 850, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 851, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 852, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 853, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 854, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 855, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 856, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 857, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 858, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 859, "data": { "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 860, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 861, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 862, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 863, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name", "content": "Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 864, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 865, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 866, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 867, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 868, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 869, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 870, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 871, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 872, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 873, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 874, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 875, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 876, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 877, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 878, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 879, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 880, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 881, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 882, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 883, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 884, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category", "content": "3" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 885, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name", "content": "Common Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 886, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder", "content": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 887, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 888, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath", "content": "Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 889, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 890, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 891, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21786" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 892, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 893, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 894, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 895, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 896, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 897, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 898, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 899, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 900, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 901, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 902, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 903, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 904, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,337", "eid": 905, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu", "content": "%ProgramData%\\Microsoft\\Windows\\Start Menu" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 906, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 907, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name", "content": "Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 908, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder", "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 909, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 910, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath", "content": "Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 911, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 912, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip", "content": "@shell32,dll,-12692" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 913, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName", "content": "@%SystemRoot%\\system32\\shell32.dll,-21797" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 914, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-117" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 915, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 916, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 917, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 918, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 919, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 920, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 921, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 922, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 923, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 924, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 925, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 926, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 927, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent", "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 928, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 929, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name", "content": "Windows" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 930, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 931, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 932, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 933, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 934, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 935, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 936, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 937, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 938, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 939, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 940, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 941, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 942, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 943, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 944, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 945, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 946, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 947, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 948, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 949, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 950, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name", "content": "System" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 951, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 952, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 953, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 954, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 955, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 956, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 957, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 958, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 959, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 960, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 961, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 962, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 963, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 964, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 965, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 966, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 967, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 968, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 969, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 970, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category", "content": "4" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 971, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name", "content": "Personal" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 972, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 973, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 974, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath", "content": "Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 975, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName", "content": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 976, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 977, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName", "content": "@%SystemRoot%\\system32\\windows.storage.dll,-21770" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 978, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon", "content": "%SystemRoot%\\system32\\imageres.dll,-112" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 979, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 980, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 981, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 982, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 983, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 984, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 985, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 986, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 987, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 988, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 989, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 990, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 991, "data": { "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal", "content": "%USERPROFILE%\\Documents" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 992, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 993, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name", "content": "Fonts" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 994, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder", "content": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 995, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 996, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 997, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 998, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 999, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1000, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1001, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1002, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1003, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1004, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1005, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1006, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1007, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1008, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1009, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1010, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1011, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,353", "eid": 1012, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,369", "eid": 1013, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask", "content": "32" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:10,369", "eid": 1014, "data": { "file": "C:\\Windows\\System32\\windows.storage.dll", "pathtofile": null, "moduleaddress": "0x7fff55710000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,369", "eid": 1015, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart", "content": "Windows.Internal.ApplicationModel.StartPinnableSurface" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:19:10,369", "eid": 1016, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience", "content": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,369", "eid": 1017, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,384", "eid": 1018, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:10,384", "eid": 1019, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,384", "eid": 1020, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:10,384", "eid": 1021, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:15,384", "eid": 1022, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:15,384", "eid": 1023, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:20,384", "eid": 1024, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "read", "object": "file", "timestamp": "2026-05-29 01:19:20,384", "eid": 1025, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:19:20,384", "eid": 1026, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:20,384", "eid": 1027, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:20,384", "eid": 1028, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "write", "object": "file", "timestamp": "2026-05-29 01:19:20,384", "eid": 1029, "data": { "file": "\\Device\\NamedPipe\\LOCAL\\mojo.4132.3092.1951462758732253055" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:17,578", "eid": 1030, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:19:17,625", "eid": 1031, "data": { "file": "\"C:\\Windows\\system32\\backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:20:01,312", "eid": 1032, "data": { "file": "C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding" } }, { "event": "execute", "object": "file", "timestamp": "2026-05-29 01:20:02,218", "eid": 1033, "data": { "file": "\"C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe\" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1034, "data": { "file": "api-ms-win-core-synch-l1-2-0.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1035, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1036, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1037, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1038, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1039, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1040, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1041, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\AppID", "content": "{7E55A26D-EF95-4A45-9F55-21E52ADF9887}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1042, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1043, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1044, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1045, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1046, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AuthenticationLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1047, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1048, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\\AccessPermission", "content": "\\x01\\x00\\x14\\x80\\x90\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00`\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1049, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1050, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1051, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\(Default)", "content": "Shield Provider User Session Agent" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1052, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1053, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1054, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1055, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{08728914-3F57-4D52-9E31-49DAECA5A80A}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1056, "data": { "file": "C:\\Windows\\system32\\rpcss.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,386", "eid": 1057, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,386", "eid": 1058, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1059, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,402", "eid": 1060, "data": { "file": "C:\\Windows\\System32\\SecurityHealthAgent.dll", "pathtofile": null, "moduleaddress": "0x1a258bb0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1061, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{91D01F44-11D0-4F2B-B516-757A456F47B1}\\ProxyStubClsid32\\(Default)", "content": "{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1062, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1063, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1064, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": "Windows Security Health Agent Proxy Stub Factory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1065, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1066, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1067, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,402", "eid": 1068, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1069, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1070, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1071, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\(Default)", "content": "Windows Security Health Agent Proxy Stub Factory" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1072, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1073, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1074, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\(Default)", "content": "%windir%\\system32\\SecurityHealthAgent.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1075, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1076, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,417", "eid": 1077, "data": { "file": "combase.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,417", "eid": 1078, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,417", "eid": 1079, "data": { "file": "C:\\Windows\\System32\\SecurityHealthProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff4c1e0000" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1080, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1081, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1082, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\DllPath", "content": "C:\\Windows\\System32\\msxml6.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1083, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Threading", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1084, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\TrustLevel", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1085, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1086, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1087, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1088, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1089, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1090, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Data.Xml.Dom.XmlDocument\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,417", "eid": 1091, "data": { "file": "C:\\Windows\\System32\\msxml6.dll", "pathtofile": null, "moduleaddress": "0x7fff52b60000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,417", "eid": 1092, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1093, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1094, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1095, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1096, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1097, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1098, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1099, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1100, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,417", "eid": 1101, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1102, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1103, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1104, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1105, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,433", "eid": 1106, "data": { "file": "C:\\Windows\\System32\\wpnapps.dll", "pathtofile": null, "moduleaddress": "0x7fff40fb0000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,433", "eid": 1107, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1108, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivationType", "content": "0" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1109, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Server", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1110, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\DllPath", "content": "C:\\Windows\\System32\\wpnapps.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1111, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Threading", "content": "2" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1112, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\TrustLevel", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1113, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\RemoteServer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1114, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateAsUser", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1115, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInSharedBroker", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1116, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateInBrokerForMediumILContainer", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1117, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1118, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\Permissions", "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1119, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotification\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1120, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\ActivateOnHostFlags", "content": "1" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1121, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1122, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)", "content": "Windows Push Notification Platform" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1123, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1124, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1125, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1126, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1127, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1128, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1129, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1130, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1131, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1132, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,433", "eid": 1133, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1134, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1135, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)", "content": "PSFactoryBuffer" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1136, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1137, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1138, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)", "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1139, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel", "content": "Both" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1140, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,449", "eid": 1141, "data": { "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff50870000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,449", "eid": 1142, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,449", "eid": 1143, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,449", "eid": 1144, "data": { "file": "C:\\Windows\\System32\\ShellCommonCommonProxyStub.dll", "pathtofile": null, "moduleaddress": "0x7fff3fd40000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,464", "eid": 1145, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1146, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1147, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1148, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1149, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1150, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0000000c-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)", "content": "{00000320-0000-0000-C000-000000000046}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1151, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,464", "eid": 1152, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\\ProxyStubClsid32\\(Default)", "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1153, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1154, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1155, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1156, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1157, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1158, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1159, "data": { "file": "oleaut32.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1160, "data": { "file": "api-ms-win-appmodel-runtime-l1-1-2", "pathtofile": null, "moduleaddress": "0x7fff55510000" } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1161, "data": { "file": null, "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1162, "data": { "file": "mscoree.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1163, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1164, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,480", "eid": 1165, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles", "content": null } }, { "event": "read", "object": "registry", "timestamp": "2026-05-29 01:20:01,480", "eid": 1166, "data": { "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck", "content": null } }, { "event": "load", "object": "library", "timestamp": "2026-05-29 01:20:01,480", "eid": 1167, "data": { "file": "ntdll.dll", "pathtofile": null, "moduleaddress": null } } ], "encryptedbuffers": [], "network_map": { "endpoint_map": {}, "http_host_map": {}, "dns_intents": {}, "http_requests": [], "winhttp_sessions": [], "com_activations": [] } }, "debug": { "log": "2026-05-28 20:55:30,758 [root] INFO: Date set to: 20260528T21:18:52, timeout set to: 60\n2026-05-28 21:18:52,011 [root] DEBUG: Starting analyzer from: C:\\lpw_albt\n2026-05-28 21:18:52,011 [root] DEBUG: Storing results at: C:\\wRMOqlspU\n2026-05-28 21:18:52,012 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\gsdfIGV\n2026-05-28 21:18:52,012 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-28 21:18:52,012 [root] INFO: analysis running as an admin\n2026-05-28 21:18:52,012 [root] INFO: analysis package specified: \"edge\"\n2026-05-28 21:18:52,012 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-28 21:18:52,016 [root] DEBUG: imported analysis package \"edge\"\n2026-05-28 21:18:52,017 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-28 21:18:52,017 [root] DEBUG: New location of moved file: https://badoomovies.com/download/BadooMovies.exe\n2026-05-28 21:18:52,017 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-28 21:18:52,017 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-28 21:18:52,018 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-28 21:18:52,018 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-28 21:18:52,032 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-28 21:18:52,045 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-28 21:18:52,052 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-28 21:18:52,057 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-28 21:18:52,062 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-28 21:18:52,062 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-28 21:18:52,063 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-28 21:18:52,064 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-28 21:18:52,065 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-28 21:18:52,065 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-28 21:18:52,066 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-28 21:18:52,066 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-28 21:18:52,066 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-28 21:18:52,067 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-28 21:18:52,067 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-28 21:18:52,067 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-28 21:18:52,067 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-28 21:18:52,068 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-28 21:18:52,068 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-28 21:18:52,068 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-28 21:18:52,068 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-28 21:18:52,068 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-28 21:18:52,069 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-28 21:18:52,073 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 712)\n2026-05-28 21:18:52,074 [modules.auxiliary.disguise] INFO: Disguising GUID to 06aa6ba2-d493-411a-8692-fe35a6c3fb7b\n2026-05-28 21:18:52,076 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-28 21:18:52,078 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-28 21:18:52,078 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-28 21:18:52,079 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-28 21:18:52,079 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-28 21:18:52,080 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-28 21:18:52,081 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-28 21:18:52,081 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-28 21:18:52,081 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-28 21:18:52,081 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-28 21:18:52,082 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-28 21:18:52,082 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-28 21:18:52,083 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-28 21:18:52,083 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-28 21:18:52,083 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-28 21:18:52,084 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-28 21:18:52,086 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-28 21:18:52,086 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-28 21:18:57,145 [root] INFO: Restarting WMI Service\n2026-05-28 21:18:59,170 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-28 21:18:59,171 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-28 21:18:59,172 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 21:18:59,173 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"https://badoomovies.com/download/BadooMovies.exe\"\" with pid 4132\n2026-05-28 21:18:59,283 [lib.api.process] INFO: Monitor config for process 4132: C:\\lpw_albt\\dll\\4132.ini\n2026-05-28 21:18:59,298 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:18:59,370 [root] DEBUG: Loader: Injecting process 4132 (thread 2012) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:18:59,371 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:18:59,371 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:18:59,373 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:01,389 [lib.api.process] INFO: Successfully resumed process with pid 4132\n2026-05-28 21:19:01,483 [root] DEBUG: 4132: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 21:19:01,484 [root] DEBUG: 4132: Disabling sleep skipping.\n2026-05-28 21:19:01,485 [root] DEBUG: 4132: Dropped file limit defaulting to 100.\n2026-05-28 21:19:01,492 [root] DEBUG: 4132: Edge-specific hook-set enabled.\n2026-05-28 21:19:01,503 [root] DEBUG: 4132: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-28 21:19:01,503 [root] DEBUG: 4132: Monitor initialised: 64-bit capemon loaded in process 4132 at 0x00007FFF17AD0000, thread 2012, image base 0x00007FF7F5380000, stack from 0x0000001B11DF1000-0x0000001B11E00000\n2026-05-28 21:19:01,504 [root] DEBUG: 4132: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://badoomovies.com/download/BadooMovies.exe\"\n2026-05-28 21:19:01,515 [root] DEBUG: 4132: Hooked 2 out of 2 functions\n2026-05-28 21:19:01,536 [root] DEBUG: 4132: Syscall hook installed, syscall logging level 1\n2026-05-28 21:19:01,541 [root] DEBUG: 4132: RestoreHeaders: Restored original import table.\n2026-05-28 21:19:01,542 [root] INFO: Loaded monitor into process with pid 4132\n2026-05-28 21:19:01,544 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 21:19:01,549 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43500000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-28 21:19:01,550 [root] DEBUG: 4132: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 21:19:01,551 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-28 21:19:01,551 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 21:19:01,552 [root] DEBUG: 4132: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-28 21:19:01,553 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 21:19:01,683 [root] DEBUG: 4132: DLL loaded at 0x00007FFF453C0000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-28 21:19:01,684 [root] DEBUG: 4132: DLL loaded at 0x00007FFEFE540000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 21:19:01,687 [root] DEBUG: 4132: DLL loaded at 0x00007FFF45010000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-28 21:19:01,689 [root] DEBUG: 4132: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 21:19:01,694 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 21:19:01,694 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 4748: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,695 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 4748\n2026-05-28 21:19:01,695 [root] DEBUG: 4132: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 21:19:01,695 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 4748\n2026-05-28 21:19:01,696 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4D260000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-28 21:19:01,697 [root] DEBUG: 4132: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 21:19:01,697 [root] DEBUG: 4132: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 21:19:01,701 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57520000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 21:19:01,701 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55EC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-28 21:19:01,702 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56750000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-28 21:19:01,703 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56A30000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 21:19:01,704 [root] DEBUG: 4132: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 21:19:01,704 [root] DEBUG: 4132: DLL loaded at 0x00007FFF19B60000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-28 21:19:01,706 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 21:19:01,707 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 21:19:01,707 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57010000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 21:19:01,708 [root] DEBUG: 4132: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 21:19:01,708 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 21:19:01,709 [root] DEBUG: 4132: DLL loaded at 0x00007FFF15300000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-28 21:19:01,709 [root] DEBUG: 4132: DLL loaded at 0x00007FFF19B20000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-28 21:19:01,710 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 21:19:01,710 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56FD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 21:19:01,711 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-28 21:19:01,712 [root] DEBUG: 4132: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 21:19:01,713 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 21:19:01,713 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52F20000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-28 21:19:01,714 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57560000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 21:19:01,721 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4D010000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-28 21:19:01,721 [root] DEBUG: 4132: DLL loaded at 0x00007FFF58380000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 21:19:01,722 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4D3D0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-28 21:19:01,723 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57490000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 21:19:01,723 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57470000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 21:19:01,724 [root] DEBUG: 4132: DLL loaded at 0x00007FFF49A90000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-28 21:19:01,727 [root] DEBUG: 4132: DLL loaded at 0x00007FFF44D50000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-28 21:19:01,729 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57350000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-28 21:19:01,729 [root] DEBUG: 4132: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 21:19:01,730 [root] DEBUG: 4132: DLL loaded at 0x00007FFF569F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-28 21:19:01,731 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52960000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-28 21:19:01,732 [root] DEBUG: 4132: DLL loaded at 0x00007FFF58B20000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-28 21:19:01,733 [root] DEBUG: 4132: DLL loaded at 0x00007FFF515C0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-28 21:19:01,733 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 21:19:01,734 [root] DEBUG: 4132: DLL loaded at 0x00007FFF515A0000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-28 21:19:01,735 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4B070000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-28 21:19:01,735 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56A40000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-28 21:19:01,736 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52860000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-28 21:19:01,739 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4CBF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 21:19:01,740 [root] DEBUG: 4132: DLL loaded at 0x00007FFF54850000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 21:19:01,741 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 21:19:01,741 [root] DEBUG: 4132: DLL loaded at 0x00007FFF54170000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 21:19:01,742 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4B680000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 21:19:01,744 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4CD70000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-28 21:19:01,745 [root] DEBUG: 4132: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 21:19:01,746 [root] DEBUG: 4132: DLL loaded at 0x00007FFF45580000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-28 21:19:01,748 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4CD40000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 21:19:01,749 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52420000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 21:19:01,752 [root] DEBUG: 4132: DLL loaded at 0x00007FFF47AB0000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-28 21:19:01,753 [root] DEBUG: 4132: DLL loaded at 0x00007FFF51A60000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-28 21:19:01,753 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4AF10000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-28 21:19:01,754 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4BFB0000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-28 21:19:01,756 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52B00000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-28 21:19:01,758 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4D6A0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-28 21:19:01,758 [root] DEBUG: 4132: DLL loaded at 0x00007FFF47980000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-28 21:19:01,759 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57360000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 21:19:01,760 [root] DEBUG: 4132: DLL loaded at 0x00007FFF515E0000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-28 21:19:01,761 [root] DEBUG: 4132: DLL loaded at 0x00007FFF51600000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-28 21:19:01,768 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52560000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-28 21:19:01,772 [root] DEBUG: 4132: DLL loaded at 0x00007FFF17040000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-28 21:19:01,787 [root] DEBUG: 4132: DLL loaded at 0x00007FFF48330000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-28 21:19:01,788 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 2916: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,789 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 2916\n2026-05-28 21:19:01,790 [root] DEBUG: 4132: DLL loaded at 0x00007FFF49D10000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-28 21:19:01,790 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 2916\n2026-05-28 21:19:01,791 [root] DEBUG: 4132: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 5708).\n2026-05-28 21:19:01,795 [root] DEBUG: 4132: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)\n2026-05-28 21:19:01,796 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 5704: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,797 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 5704\n2026-05-28 21:19:01,797 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 5704\n2026-05-28 21:19:01,800 [root] DEBUG: 4132: DLL loaded at 0x00007FFF573C0000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-28 21:19:01,809 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43590000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-28 21:19:01,811 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 4388: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,811 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 4388\n2026-05-28 21:19:01,812 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 4388\n2026-05-28 21:19:01,813 [root] DEBUG: 4132: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 21:19:01,813 [root] DEBUG: 4132: DLL loaded at 0x00007FFF409A0000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-28 21:19:01,844 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55EF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-28 21:19:01,844 [root] DEBUG: 4132: DLL loaded at 0x00007FFF53070000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-28 21:19:01,845 [root] DEBUG: 4132: DLL loaded at 0x00007FFF538A0000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-28 21:19:01,845 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43630000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-28 21:19:01,867 [root] DEBUG: 4132: DLL loaded at 0x00007FFF3F8A0000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-28 21:19:01,880 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55220000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-28 21:19:01,887 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 7928: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,888 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43990000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-28 21:19:01,889 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 7928\n2026-05-28 21:19:01,889 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 7460: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:01,889 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 7460\n2026-05-28 21:19:01,890 [root] DEBUG: 4132: DLL loaded at 0x00007FFF488B0000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-28 21:19:01,890 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 7928\n2026-05-28 21:19:01,890 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 7460\n2026-05-28 21:19:01,939 [root] DEBUG: 4132: DLL loaded at 0x00007FFF456D0000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-28 21:19:01,945 [root] DEBUG: 4132: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 21:19:01,967 [root] DEBUG: 4132: DLL loaded at 0x00007FFF181E0000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-28 21:19:01,975 [root] DEBUG: 4132: DLL loaded at 0x00007FFF3E730000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-28 21:19:01,979 [root] DEBUG: 4132: DLL loaded at 0x00007FFF42BF0000: C:\\Windows\\SYSTEM32\\VCRUNTIME140 (0x1e000 bytes).\n2026-05-28 21:19:01,983 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4CFA0000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Domain Actions\\3.0.0.18\\domain_actions (0x17000 bytes).\n2026-05-28 21:19:02,012 [root] DEBUG: 4132: DLL loaded at 0x00007FFF18150000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-28 21:19:02,021 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57130000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-28 21:19:02,023 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56EF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 21:19:02,024 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56630000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 21:19:03,255 [root] DEBUG: 4132: DLL loaded at 0x00007FFF3FD40000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-28 21:19:03,700 [root] DEBUG: 4132: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 21:19:03,701 [root] DEBUG: 4132: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 21:19:06,895 [root] DEBUG: 4132: DLL loaded at 0x00007FFF59A80000: C:\\Windows\\System32\\SETUPAPI (0x46e000 bytes).\n2026-05-28 21:19:06,897 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 1252: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:06,897 [root] DEBUG: 4132: DLL loaded at 0x00007FFF572F0000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 21:19:06,897 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 1252\n2026-05-28 21:19:06,898 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 972: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:06,898 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 1252\n2026-05-28 21:19:06,898 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 972\n2026-05-28 21:19:06,899 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 972\n2026-05-28 21:19:06,918 [root] DEBUG: 4132: DLL loaded at 0x00007FFF140B0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient (0x3ed000 bytes).\n2026-05-28 21:19:06,938 [root] DEBUG: 4132: DLL loaded at 0x00007FFF54B30000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-28 21:19:06,939 [root] DEBUG: 4132: DLL loaded at 0x00007FFF16BD0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg (0x467000 bytes).\n2026-05-28 21:19:06,942 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57AA0000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 21:19:06,947 [root] DEBUG: 4132: DLL loaded at 0x00007FFF13A50000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds (0x33f000 bytes).\n2026-05-28 21:19:06,951 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4F560000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-28 21:19:06,953 [root] DEBUG: 4132: DLL loaded at 0x00007FFF3F6A0000: C:\\Windows\\system32\\TenantRestrictionsPlugin (0x1b000 bytes).\n2026-05-28 21:19:06,955 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 5384: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF7DA540000\n2026-05-28 21:19:06,955 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56250000: C:\\Windows\\System32\\FirewallAPI (0x96000 bytes).\n2026-05-28 21:19:06,956 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 5384\n2026-05-28 21:19:06,956 [root] DEBUG: 4132: DLL loaded at 0x00007FFF561E0000: C:\\Windows\\System32\\fwbase (0x36000 bytes).\n2026-05-28 21:19:06,956 [lib.api.process] INFO: Monitor config for process 5384: C:\\lpw_albt\\dll\\5384.ini\n2026-05-28 21:19:06,958 [root] DEBUG: 4132: DLL loaded at 0x00007FFF180D0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration (0x78000 bytes).\n2026-05-28 21:19:06,963 [root] DEBUG: 4132: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 21:19:06,964 [root] DEBUG: 4132: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 21:19:06,964 [root] DEBUG: 4132: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 21:19:07,276 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-28 21:19:07,276 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 21:19:07,278 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-28 21:19:07,278 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 21:19:07,278 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-28 21:19:07,279 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-28 21:19:07,279 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-28 21:19:07,279 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-28 21:19:07,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:07,286 [root] DEBUG: Loader: Injecting process 5384 (thread 2800) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,286 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:19:07,287 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,288 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:07,293 [root] DEBUG: 4132: DLL loaded at 0x00007FFF501A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 21:19:07,294 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4CBD0000: C:\\Windows\\SYSTEM32\\windows.staterepositorycore (0x11000 bytes).\n2026-05-28 21:19:07,295 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 8972: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF7DA540000\n2026-05-28 21:19:07,296 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 8972\n2026-05-28 21:19:07,296 [lib.api.process] INFO: Monitor config for process 8972: C:\\lpw_albt\\dll\\8972.ini\n2026-05-28 21:19:07,350 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4F950000: C:\\Windows\\system32\\wlanapi (0x74000 bytes).\n2026-05-28 21:19:07,352 [root] DEBUG: 4132: DLL loaded at 0x00007FFF457F0000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 21:19:07,353 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4F740000: C:\\Windows\\System32\\AppXDeploymentClient (0x102000 bytes).\n2026-05-28 21:19:07,367 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-28 21:19:07,368 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-28 21:19:07,369 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-28 21:19:07,370 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:07,375 [root] DEBUG: Loader: Injecting process 8972 (thread 8608) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,376 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:19:07,376 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,377 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:07,379 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 8972\n2026-05-28 21:19:07,379 [lib.api.process] INFO: Monitor config for process 8972: C:\\lpw_albt\\dll\\8972.ini\n2026-05-28 21:19:07,386 [root] DEBUG: 4132: DLL loaded at 0x00007FFF43550000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 21:19:07,400 [root] DEBUG: 4132: DLL loaded at 0x00007FFF57010000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 21:19:07,401 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56FD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 21:19:07,402 [root] DEBUG: 4132: DLL loaded at 0x00007FFF50370000: C:\\Windows\\system32\\PCPKsp (0x118000 bytes).\n2026-05-28 21:19:07,403 [root] DEBUG: 4132: DLL loaded at 0x00007FFF59EF0000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 21:19:07,404 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4FA10000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 21:19:07,404 [root] DEBUG: 4132: DLL loaded at 0x00007FFF45050000: C:\\Windows\\system32\\ncryptprov (0x5a000 bytes).\n2026-05-28 21:19:07,457 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll\n2026-05-28 21:19:07,457 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll\n2026-05-28 21:19:07,458 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll\n2026-05-28 21:19:07,460 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:07,464 [root] DEBUG: Loader: Injecting process 8972 (thread 8608) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,465 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 21:19:07,465 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:07,466 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:07,489 [root] DEBUG: 8972: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 21:19:07,489 [root] DEBUG: 8972: Dropped file limit defaulting to 100.\n2026-05-28 21:19:07,496 [root] DEBUG: 8972: Disabling sleep skipping.\n2026-05-28 21:19:07,502 [root] DEBUG: 8972: YaraInit: Compiled 44 rule files\n2026-05-28 21:19:07,503 [root] DEBUG: 8972: YaraInit: Compiled rules saved to file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-28 21:19:07,517 [root] DEBUG: 8972: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-28 21:19:07,517 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56D00000: C:\\Windows\\system32\\mswsock (0x6a000 bytes).\n2026-05-28 21:19:07,518 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,536 [root] DEBUG: 8972: Monitor initialised: 64-bit capemon loaded in process 8972 at 0x00007FFF17AD0000, thread 8608, image base 0x00007FF7DA540000, stack from 0x0000007121AF1000-0x0000007121B00000\n2026-05-28 21:19:07,537 [root] DEBUG: 8972: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5484,i,16682385157051867027,9882385662020069020,524288 --field-trial-handle=2332,i,7160788429019893685,10299558798743960205,262144 --variations-seed-version --pseudonymization-salt-handle=2336,i,11924026469095214904,2916500198826238\n2026-05-28 21:19:07,537 [root] DEBUG: 8972: add_all_dlls_to_dll_ranges: skipping C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll\n2026-05-28 21:19:07,547 [root] DEBUG: 8972: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-28 21:19:07,570 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 21:19:07,571 [root] DEBUG: 8972: set_hooks: Unable to hook LockResource\n2026-05-28 21:19:07,578 [root] DEBUG: 8972: Hooked 627 out of 628 functions\n2026-05-28 21:19:07,594 [root] DEBUG: 8972: Syscall hook installed, syscall logging level 1\n2026-05-28 21:19:07,599 [root] DEBUG: 8972: RestoreHeaders: Restored original import table.\n2026-05-28 21:19:07,599 [root] INFO: Loaded monitor into process with pid 8972\n2026-05-28 21:19:07,600 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,650 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,681 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,705 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,728 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,753 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,778 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FFF17610000, size 0x4b9994\n2026-05-28 21:19:07,805 [root] DEBUG: 8972: caller_dispatch: Added region at 0x00007FFF17610000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFF1780F156, thread 8608).\n2026-05-28 21:19:07,806 [root] DEBUG: 8972: caller_dispatch: Scanning calling region at 0x00007FFF17610000...\n2026-05-28 21:19:07,810 [root] DEBUG: 8972: ProcessTrackedRegion: Region at 0x00007FFF17610000 mapped as \\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll appears unmodified, skipping\n2026-05-28 21:19:07,814 [root] DEBUG: 8972: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 21:19:07,835 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,850 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,865 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,881 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,896 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,911 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,928 [root] DEBUG: 8972: caller_dispatch: Added region at 0x00007FF7DA540000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF7DA634096, thread 8608).\n2026-05-28 21:19:07,928 [root] DEBUG: 8972: YaraScan: Scanning 0x00007FF7DA540000, size 0x28b4d8\n2026-05-28 21:19:07,944 [root] DEBUG: 8972: ProcessImageBase: Main module image at 0x00007FF7DA540000 unmodified (entropy change 0.000000e+00)\n2026-05-28 21:19:07,947 [root] DEBUG: 8972: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 21:19:07,972 [root] DEBUG: 8972: DLL loaded at 0x0000024647000000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 21:19:07,974 [root] DEBUG: 8972: DLL loaded at 0x00007FFF54FC0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 21:19:07,976 [root] DEBUG: 8972: DLL loaded at 0x00007FFF58380000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 21:19:08,006 [root] DEBUG: 8972: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 21:19:08,010 [root] DEBUG: 8972: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 21:19:08,014 [root] DEBUG: 8972: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 21:19:08,015 [root] DEBUG: 8972: DLL loaded at 0x00007FFF52860000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-28 21:19:08,015 [root] DEBUG: 8972: DLL loaded at 0x00007FFF54850000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 21:19:08,016 [root] DEBUG: 8972: DLL loaded at 0x00007FFF46D30000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-28 21:19:08,024 [root] DEBUG: 8972: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 21:19:08,024 [root] DEBUG: 8972: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 21:19:08,025 [root] DEBUG: 8972: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 21:19:08,025 [root] DEBUG: 8972: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 21:19:08,026 [root] DEBUG: 8972: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 21:19:08,038 [root] DEBUG: 8972: DLL loaded at 0x00007FFF48780000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 21:19:08,046 [root] DEBUG: 8972: DLL loaded at 0x00007FFF46AE0000: C:\\Windows\\system32\\execmodelproxy (0x18000 bytes).\n2026-05-28 21:19:08,051 [root] DEBUG: 8972: DLL loaded at 0x00007FFF566C0000: C:\\Windows\\System32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 21:19:08,051 [root] DEBUG: 8972: DLL loaded at 0x00007FFF522D0000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 21:19:08,054 [root] DEBUG: 8972: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 21:19:08,065 [root] DEBUG: 8972: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 21:19:08,065 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4CBF0000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 21:19:08,075 [root] DEBUG: 8972: DLL loaded at 0x00007FFF57AA0000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 21:19:08,076 [root] DEBUG: 8972: DLL loaded at 0x00007FFF501A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 21:19:08,080 [root] DEBUG: 8972: DLL loaded at 0x00007FFF57130000: C:\\Windows\\System32\\MSASN1 (0x12000 bytes).\n2026-05-28 21:19:08,088 [root] DEBUG: 8972: DLL loaded at 0x00007FFF457F0000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 21:19:08,094 [root] DEBUG: 8972: DLL loaded at 0x000002465D490000: C:\\Windows\\System32\\CryptoWinRT (0x61000 bytes).\n2026-05-28 21:19:08,099 [lib.api.process] INFO: Monitor config for process 832: C:\\lpw_albt\\dll\\832.ini\n2026-05-28 21:19:08,101 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:08,105 [root] DEBUG: Loader: Injecting process 832 with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:08,107 [root] DEBUG: 832: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 21:19:08,107 [root] DEBUG: 832: Disabling sleep skipping.\n2026-05-28 21:19:08,108 [root] DEBUG: 832: Dropped file limit defaulting to 100.\n2026-05-28 21:19:08,109 [root] DEBUG: 832: Services hook set enabled\n2026-05-28 21:19:08,110 [root] DEBUG: 832: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-28 21:19:08,122 [root] DEBUG: 832: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-28 21:19:08,122 [root] DEBUG: 832: Monitor initialised: 64-bit capemon loaded in process 832 at 0x00007FFF17AD0000, thread 3532, image base 0x00007FF7BF220000, stack from 0x000000CCA7AF5000-0x000000CCA7B00000\n2026-05-28 21:19:08,122 [root] DEBUG: 832: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-05-28 21:19:08,133 [root] DEBUG: 832: Hooked 69 out of 69 functions\n2026-05-28 21:19:08,134 [root] INFO: Loaded monitor into process with pid 832\n2026-05-28 21:19:08,134 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 21:19:08,135 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:08,136 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:10,192 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4B780000: C:\\Windows\\System32\\StateRepository.Core (0xb1000 bytes).\n2026-05-28 21:19:10,194 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4B840000: C:\\Windows\\System32\\Windows.StateRepository (0x58e000 bytes).\n2026-05-28 21:19:10,195 [root] DEBUG: 8972: DLL loaded at 0x00007FFF43150000: C:\\Windows\\System32\\TileDataRepository (0x99000 bytes).\n2026-05-28 21:19:10,197 [root] DEBUG: 8972: DLL loaded at 0x00007FFF3D7B0000: C:\\Windows\\System32\\biwinrt (0x53000 bytes).\n2026-05-28 21:19:10,210 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4F6E0000: C:\\Windows\\System32\\usermgrproxy (0x54000 bytes).\n2026-05-28 21:19:10,230 [root] DEBUG: 8972: DLL loaded at 0x00007FFF55EF0000: C:\\Windows\\System32\\dxgi (0xf3000 bytes).\n2026-05-28 21:19:10,231 [root] DEBUG: 8972: DLL loaded at 0x00007FFF53070000: C:\\Windows\\System32\\d3d11 (0x263000 bytes).\n2026-05-28 21:19:10,237 [root] DEBUG: 8972: DLL loaded at 0x00007FFF48B40000: C:\\Windows\\System32\\WININET (0x4d6000 bytes).\n2026-05-28 21:19:10,237 [root] DEBUG: 8972: DLL loaded at 0x00007FFF3D6A0000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-28 21:19:10,250 [root] DEBUG: 8972: DLL loaded at 0x00007FFF43060000: C:\\Windows\\System32\\PCShellCommonProxyStub (0x13000 bytes).\n2026-05-28 21:19:10,271 [root] DEBUG: 8972: DLL loaded at 0x00007FFF57520000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-05-28 21:19:10,272 [root] DEBUG: 8972: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\System32\\Wldp (0x2d000 bytes).\n2026-05-28 21:19:10,272 [root] DEBUG: 8972: DLL loaded at 0x00007FFF55710000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 21:19:10,272 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4C520000: C:\\Windows\\System32\\Bcp47Langs (0x5b000 bytes).\n2026-05-28 21:19:10,273 [root] DEBUG: 8972: DLL loaded at 0x00007FFF43DD0000: C:\\Windows\\System32\\StartTileData (0x58a000 bytes).\n2026-05-28 21:19:10,282 [root] DEBUG: 8972: DLL loaded at 0x00007FFF3D810000: C:\\Windows\\System32\\Windows.Storage.ApplicationData (0x66000 bytes).\n2026-05-28 21:19:10,299 [root] DEBUG: 8972: DLL loaded at 0x00007FFF4CD40000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 21:19:10,333 [root] DEBUG: 8972: DLL loaded at 0x00007FFF57750000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 21:19:17,563 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 8504: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-28 21:19:17,564 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8504\n2026-05-28 21:19:17,564 [lib.api.process] INFO: Monitor config for process 8504: C:\\lpw_albt\\dll\\8504.ini\n2026-05-28 21:19:17,566 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:17,570 [root] DEBUG: Loader: Injecting process 8504 (thread 7064) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,570 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:19:17,570 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,572 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:17,573 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8504\n2026-05-28 21:19:17,573 [lib.api.process] INFO: Monitor config for process 8504: C:\\lpw_albt\\dll\\8504.ini\n2026-05-28 21:19:17,574 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:17,578 [root] DEBUG: Loader: Injecting process 8504 (thread 7064) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,579 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 21:19:17,579 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,580 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:17,581 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8504\n2026-05-28 21:19:17,581 [lib.api.process] INFO: Monitor config for process 8504: C:\\lpw_albt\\dll\\8504.ini\n2026-05-28 21:19:17,582 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:17,586 [root] DEBUG: Loader: Injecting process 8504 with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,586 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 7064, handle 0x120\n2026-05-28 21:19:17,586 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 21:19:17,587 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,588 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:17,596 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 2076: C:\\Windows\\system32\\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000\n2026-05-28 21:19:17,597 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 2076\n2026-05-28 21:19:17,597 [lib.api.process] INFO: Monitor config for process 2076: C:\\lpw_albt\\dll\\2076.ini\n2026-05-28 21:19:17,598 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:17,602 [root] DEBUG: Loader: Injecting process 2076 (thread 2560) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,602 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:19:17,603 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,604 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:17,606 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 2076\n2026-05-28 21:19:17,606 [lib.api.process] INFO: Monitor config for process 2076: C:\\lpw_albt\\dll\\2076.ini\n2026-05-28 21:19:17,608 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:19:17,611 [root] DEBUG: Loader: Injecting process 2076 (thread 2560) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,612 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 21:19:17,612 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:19:17,613 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:19:17,615 [root] INFO: Process with pid 2076 has terminated\n2026-05-28 21:19:20,407 [root] INFO: Process with pid 8972 has terminated\n2026-05-28 21:19:20,409 [root] DEBUG: 8972: NtTerminateProcess hook: Attempting to dump process 8972\n2026-05-28 21:19:20,410 [root] DEBUG: 8972: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 21:19:29,736 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 8828: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:29,737 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 8828\n2026-05-28 21:19:29,738 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 8828\n2026-05-28 21:19:30,764 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 9124: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:30,766 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 9124\n2026-05-28 21:19:30,768 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 9124\n2026-05-28 21:19:31,694 [root] DEBUG: 4132: DLL loaded at 0x00007FFF3EFA0000: C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).\n2026-05-28 21:19:31,771 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 6148: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:31,772 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 6148\n2026-05-28 21:19:31,773 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 6148\n2026-05-28 21:19:57,141 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 3348: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:19:57,143 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 3348\n2026-05-28 21:19:57,143 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 3348\n2026-05-28 21:20:01,298 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 5232: C:\\Windows\\System32\\SecurityHealthHost.exe, ImageBase: 0x00007FF71C070000\n2026-05-28 21:20:01,300 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 5232\n2026-05-28 21:20:01,300 [lib.api.process] INFO: Monitor config for process 5232: C:\\lpw_albt\\dll\\5232.ini\n2026-05-28 21:20:01,302 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:20:01,305 [root] DEBUG: Loader: Injecting process 5232 (thread 6740) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:01,306 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:20:01,306 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:01,307 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:20:01,309 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 5232\n2026-05-28 21:20:01,309 [lib.api.process] INFO: Monitor config for process 5232: C:\\lpw_albt\\dll\\5232.ini\n2026-05-28 21:20:01,310 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:20:01,314 [root] DEBUG: Loader: Injecting process 5232 (thread 6740) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:01,314 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 21:20:01,315 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:01,316 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:20:01,322 [root] DEBUG: 5232: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 21:20:01,322 [root] DEBUG: 5232: Dropped file limit defaulting to 100.\n2026-05-28 21:20:01,325 [root] DEBUG: 5232: Disabling sleep skipping.\n2026-05-28 21:20:01,325 [root] DEBUG: 5232: YaraInit: Compiled rules loaded from existing file C:\\lpw_albt\\data\\yara\\capemon.yac\n2026-05-28 21:20:01,337 [root] DEBUG: 5232: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0\n2026-05-28 21:20:01,337 [root] DEBUG: 5232: YaraScan: Scanning 0x00007FF71C070000, size 0x19174\n2026-05-28 21:20:01,339 [root] DEBUG: 5232: Monitor initialised: 64-bit capemon loaded in process 5232 at 0x00007FFF17AD0000, thread 6740, image base 0x00007FF71C070000, stack from 0x00000098A50D4000-0x00000098A50E0000\n2026-05-28 21:20:01,339 [root] DEBUG: 5232: Commandline: C:\\Windows\\System32\\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding\n2026-05-28 21:20:01,347 [root] DEBUG: 5232: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress\n2026-05-28 21:20:01,368 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 21:20:01,370 [root] DEBUG: 5232: set_hooks: Unable to hook LockResource\n2026-05-28 21:20:01,374 [root] DEBUG: 5232: Hooked 627 out of 628 functions\n2026-05-28 21:20:01,376 [root] DEBUG: 5232: Syscall hook installed, syscall logging level 1\n2026-05-28 21:20:01,380 [root] DEBUG: 5232: RestoreHeaders: Restored original import table.\n2026-05-28 21:20:01,380 [root] INFO: Loaded monitor into process with pid 5232\n2026-05-28 21:20:01,381 [root] DEBUG: 5232: caller_dispatch: Added region at 0x00007FF71C070000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF71C07D3B2, thread 6740).\n2026-05-28 21:20:01,381 [root] DEBUG: 5232: YaraScan: Scanning 0x00007FF71C070000, size 0x19174\n2026-05-28 21:20:01,383 [root] DEBUG: 5232: ProcessImageBase: Main module image at 0x00007FF71C070000 unmodified (entropy change 0.000000e+00)\n2026-05-28 21:20:01,385 [root] DEBUG: 5232: DLL loaded at 0x00007FFF55510000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 21:20:01,386 [root] DEBUG: 5232: DLL loaded at 0x00007FFF57EF0000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 21:20:01,388 [root] DEBUG: 5232: DLL loaded at 0x00007FFF58B30000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 21:20:01,403 [root] DEBUG: 5232: DLL loaded at 0x00007FFF56FA0000: C:\\Windows\\system32\\Wldp (0x2d000 bytes).\n2026-05-28 21:20:01,404 [root] DEBUG: 5232: DLL loaded at 0x00007FFF56770000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 21:20:01,404 [root] DEBUG: 5232: DLL loaded at 0x000001A258BB0000: C:\\Windows\\system32\\SecurityHealthAgent (0x6d000 bytes).\n2026-05-28 21:20:01,420 [root] DEBUG: 5232: DLL loaded at 0x00007FFF4C1E0000: C:\\Windows\\system32\\SecurityHealthProxyStub (0x1f000 bytes).\n2026-05-28 21:20:01,423 [root] DEBUG: 5232: DLL loaded at 0x00007FFF52B60000: C:\\Windows\\System32\\msxml6 (0x25f000 bytes).\n2026-05-28 21:20:01,428 [root] DEBUG: 5232: DLL loaded at 0x00007FFF58070000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 21:20:01,429 [root] DEBUG: 5232: DLL loaded at 0x00007FFF52DC0000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 21:20:01,429 [root] DEBUG: 5232: DLL loaded at 0x00007FFF55410000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 21:20:01,430 [root] DEBUG: 5232: DLL loaded at 0x00007FFF523E0000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 21:20:01,431 [root] DEBUG: 5232: DLL loaded at 0x00007FFF517C0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 21:20:01,431 [root] DEBUG: 5232: DLL loaded at 0x00007FFF40FB0000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 21:20:01,435 [root] DEBUG: 5232: DLL loaded at 0x00007FFF52490000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 21:20:01,446 [root] DEBUG: 5232: DLL loaded at 0x00007FFF50870000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 21:20:01,455 [root] DEBUG: 5232: DLL loaded at 0x00007FFF3FD40000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-28 21:20:01,479 [root] DEBUG: 5232: NtTerminateProcess hook: Attempting to dump process 5232\n2026-05-28 21:20:01,480 [root] DEBUG: 5232: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 21:20:01,488 [root] INFO: Process with pid 5232 has terminated\n2026-05-28 21:20:01,504 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 2436: C:\\Windows\\SystemApps\\ShellExperienceHost_cw5n1h2txyewy\\ShellExperienceHost.exe, ImageBase: 0x00007FF645A20000\n2026-05-28 21:20:01,505 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 2436\n2026-05-28 21:20:01,505 [lib.api.process] INFO: Monitor config for process 2436: C:\\lpw_albt\\dll\\2436.ini\n2026-05-28 21:20:01,761 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56140000: C:\\Windows\\SYSTEM32\\sppc (0x25000 bytes).\n2026-05-28 21:20:01,762 [root] DEBUG: 4132: DLL loaded at 0x00007FFF56170000: C:\\Windows\\system32\\slc (0x29000 bytes).\n2026-05-28 21:20:01,763 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4F220000: C:\\Windows\\system32\\slwga (0x19000 bytes).\n2026-05-28 21:20:01,778 [root] DEBUG: 4132: DLL loaded at 0x00007FFF4D360000: C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).\n2026-05-28 21:20:01,823 [root] DEBUG: 4132: CreateProcessHandler: Injection info set for new process 6460: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF7F5380000\n2026-05-28 21:20:01,824 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 6460\n2026-05-28 21:20:01,825 [root] DEBUG: 4132: ProcessMessage: Skipping monitoring process 6460\n2026-05-28 21:20:01,902 [root] DEBUG: 4132: DLL loaded at 0x00007FFF17EF0000: C:\\Windows\\System32\\CloudExperienceHostCommon (0x128000 bytes).\n2026-05-28 21:20:01,942 [root] INFO: Analysis timeout hit, terminating analysis\n2026-05-28 21:20:01,943 [lib.api.process] INFO: Terminate event set for process 4132\n2026-05-28 21:20:01,944 [root] DEBUG: 4132: Terminate Event: Attempting to dump process 4132\n2026-05-28 21:20:01,947 [root] DEBUG: 4132: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 21:20:01,960 [lib.api.process] INFO: Termination confirmed for process 4132\n2026-05-28 21:20:01,960 [root] DEBUG: 4132: Terminate Event: monitor shutdown complete for process 4132\n2026-05-28 21:20:01,960 [root] INFO: Terminate event set for process 4132\n2026-05-28 21:20:01,961 [lib.api.process] INFO: Terminate event set for process 832\n2026-05-28 21:20:01,961 [root] DEBUG: 832: Terminate Event: Attempting to dump process 832\n2026-05-28 21:20:01,962 [root] DEBUG: 832: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 21:20:01,964 [lib.api.process] INFO: Termination confirmed for process 832\n2026-05-28 21:20:01,964 [root] INFO: Terminate event set for process 832\n2026-05-28 21:20:01,965 [root] INFO: Created shutdown mutex\n2026-05-28 21:20:01,964 [root] DEBUG: 832: Terminate Event: monitor shutdown complete for process 832\n2026-05-28 21:20:02,200 [lib.api.process] INFO: 64-bit DLL to inject is C:\\lpw_albt\\dll\\SlxjJjW.dll, loader C:\\lpw_albt\\bin\\eXPvwUns.exe\n2026-05-28 21:20:02,205 [root] DEBUG: Loader: Injecting process 2436 (thread 5812) with C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:02,206 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 21:20:02,207 [root] DEBUG: Successfully injected DLL C:\\lpw_albt\\dll\\SlxjJjW.dll.\n2026-05-28 21:20:02,208 [lib.api.process] INFO: Injected into 64-bit \n2026-05-28 21:20:02,978 [root] INFO: Shutting down package\n2026-05-28 21:20:02,978 [root] INFO: Stopping auxiliary modules\n2026-05-28 21:20:02,979 [root] INFO: Stopping auxiliary module: Browser\n2026-05-28 21:20:02,979 [root] INFO: Stopping auxiliary module: Human\n2026-05-28 21:20:03,938 [root] INFO: Stopping auxiliary module: Screenshots\n2026-05-28 21:20:03,938 [root] INFO: Finishing auxiliary modules\n2026-05-28 21:20:03,939 [root] INFO: Shutting down pipe server and dumping dropped files\n2026-05-28 21:20:03,939 [root] WARNING: Folder at path \"C:\\wRMOqlspU\\debugger\" does not exist, skipping\n2026-05-28 21:20:03,939 [root] WARNING: Folder at path \"C:\\wRMOqlspU\\tlsdump\" does not exist, skipping\n2026-05-28 21:20:03,971 [root] WARNING: Monitor injection attempted but failed for process 5384\n2026-05-28 21:20:03,971 [root] WARNING: Monitor injection attempted but failed for process 8504\n2026-05-28 21:20:03,972 [root] WARNING: Monitor injection attempted but failed for process 2076\n2026-05-28 21:20:03,973 [root] WARNING: Monitor injection attempted but failed for process 2436\n2026-05-28 21:20:03,973 [root] INFO: Analysis completed\n", "errors": [] }, "network": { "pcap_sha256": "e5af81c70d0b62aa2c000b0acdd7d5df0469606d919f6751634225c2987946af", "hosts": [ { "ip": "150.171.109.19", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.211.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.211.129.205", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "146.75.119.82", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "205.196.6.132", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "cmp1-sea1.steamserver.net", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.254.195.69", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "162.254.195.75", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.22", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] }, { "ip": "23.216.106.59", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "api.steampowered.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "23.56.110.169", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.128.235", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "latency.discord.media", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.138.232", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "status.discord.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.232", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "status.discord.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.133.234", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "gateway-us-east1-c.discord.gg", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "discordapp.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "185.247.139.200", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "badoomovies.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.133.233", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "discordapp.com", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "162.159.135.234", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "gateway-us-east1-c.discord.gg", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "142.250.195.131", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "c.pki.goog", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "23.221.49.11", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "steamconnecttest.com", "inaddrarpa": "", "ports": [ 80 ] }, { "ip": "172.172.255.218", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "199.232.215.52", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 443 ] }, { "ip": "103.10.125.23", "country_name": "unknown", "asn": "", "asn_name": "", "hostname": "", "inaddrarpa": "", "ports": [ 27018 ] } ], "domains": [ { "domain": "api.steampowered.com", "ip": "23.216.106.59" }, { "domain": "ipv6check-udp.steamserver.net", "ip": "" }, { "domain": "ipv6check-http.steamserver.net", "ip": "" }, { "domain": "steamconnecttest.com", "ip": "23.56.110.51" }, { "domain": "c.pki.goog", "ip": "142.250.207.3" }, { "domain": "badoomovies.com", "ip": "185.247.139.200" }, { "domain": "discordapp.com", "ip": "162.159.129.233" }, { "domain": "gateway-us-east1-c.discord.gg", "ip": "162.159.135.234" }, { "domain": "status.discord.com", "ip": "162.159.137.232" }, { "domain": "cdn.discordapp.com", "ip": "162.159.134.233" }, { "domain": "updates.discord.com", "ip": "162.159.137.232" }, { "domain": "dns.google", "ip": "8.8.4.4" }, { "domain": "cmp1-sea1.steamserver.net", "ip": "205.196.6.132" }, { "domain": "p2p-syd1.discovery.steamserver.net", "ip": "103.10.125.24" }, { "domain": "latency.discord.media", "ip": "162.159.138.234" } ], "tcp": [ { "src": "192.168.1.105", "sport": 49716, "dst": "103.10.125.23", "dport": 27018, "offset": 24, "time": 0.0 }, { "src": "192.168.1.105", "sport": 49729, "dst": "199.232.215.52", "dport": 443, "offset": 314, "time": 0.3325340747833252 }, { "src": "192.168.1.105", "sport": 49732, "dst": "172.172.255.218", "dport": 443, "offset": 1160, "time": 0.6896600723266602 }, { "src": "192.168.1.105", "sport": 49680, "dst": "172.172.255.218", "dport": 443, "offset": 10497, "time": 0.8034930229187012 }, { "src": "192.168.1.105", "sport": 49757, "dst": "23.221.49.11", "dport": 80, "offset": 22522, "time": 1.025635004043579 }, { "src": "192.168.1.105", "sport": 49760, "dst": "199.232.214.172", "dport": 80, "offset": 39984, "time": 2.138340950012207 }, { "src": "192.168.1.105", "sport": 49761, "dst": "142.250.195.131", "dport": 80, "offset": 42160, "time": 2.198280096054077 }, { "src": "192.168.1.105", "sport": 49762, "dst": "23.202.165.79", "dport": 80, "offset": 43750, "time": 2.2692201137542725 }, { "src": "192.168.1.105", "sport": 49764, "dst": "40.74.78.229", "dport": 443, "offset": 58746, "time": 4.354480028152466 }, { "src": "192.168.1.105", "sport": 49702, "dst": "162.159.135.234", "dport": 443, "offset": 73636, "time": 9.354367971420288 }, { "src": "192.168.1.105", "sport": 49728, "dst": "162.159.133.233", "dport": 443, "offset": 74173, "time": 10.63007402420044 }, { "src": "192.168.1.105", "sport": 49767, "dst": "150.171.22.17", "dport": 443, "offset": 80395, "time": 10.661426067352295 }, { "src": "192.168.1.105", "sport": 49768, "dst": "162.159.135.233", "dport": 443, "offset": 94679, "time": 10.697611093521118 }, { "src": "192.168.1.105", "sport": 49772, "dst": "162.159.133.234", "dport": 443, "offset": 143543, "time": 10.890933990478516 }, { "src": "192.168.1.105", "sport": 49777, "dst": "150.171.22.17", "dport": 443, "offset": 198436, "time": 13.111951112747192 }, { "src": "192.168.1.105", "sport": 49779, "dst": "162.159.138.232", "dport": 443, "offset": 212289, "time": 14.128749132156372 }, { "src": "192.168.1.105", "sport": 49731, "dst": "162.159.128.235", "dport": 443, "offset": 248756, "time": 14.809232950210571 }, { "src": "192.168.1.105", "sport": 49783, "dst": "162.159.61.3", "dport": 443, "offset": 279486, "time": 15.569998979568481 }, { "src": "192.168.1.105", "sport": 49781, "dst": "8.8.4.4", "dport": 443, "offset": 293137, "time": 15.576153993606567 }, { "src": "192.168.1.105", "sport": 49785, "dst": "23.56.110.169", "dport": 443, "offset": 327014, "time": 15.61044692993164 }, { "src": "192.168.1.105", "sport": 49787, "dst": "150.171.27.11", "dport": 443, "offset": 384180, "time": 15.922199964523315 }, { "src": "192.168.1.105", "sport": 49793, "dst": "23.216.106.59", "dport": 443, "offset": 419553, "time": 18.51912212371826 }, { "src": "192.168.1.105", "sport": 49796, "dst": "103.10.125.22", "dport": 27018, "offset": 429080, "time": 18.833164930343628 }, { "src": "192.168.1.105", "sport": 49794, "dst": "103.10.125.23", "dport": 443, "offset": 429667, "time": 18.8333101272583 }, { "src": "192.168.1.105", "sport": 49795, "dst": "103.10.125.23", "dport": 27018, "offset": 430254, "time": 18.836738109588623 }, { "src": "192.168.1.105", "sport": 49797, "dst": "162.254.195.75", "dport": 443, "offset": 444679, "time": 18.95145010948181 }, { "src": "192.168.1.105", "sport": 49798, "dst": "162.254.195.69", "dport": 27018, "offset": 448987, "time": 19.14422607421875 }, { "src": "192.168.1.105", "sport": 49800, "dst": "205.196.6.132", "dport": 27018, "offset": 450206, "time": 19.208379983901978 }, { "src": "192.168.1.105", "sport": 49799, "dst": "205.196.6.132", "dport": 443, "offset": 450793, "time": 19.20849299430847 }, { "src": "192.168.1.105", "sport": 49753, "dst": "146.75.119.82", "dport": 443, "offset": 481116, "time": 27.263689041137695 }, { "src": "192.168.1.105", "sport": 49803, "dst": "172.172.255.218", "dport": 443, "offset": 482029, "time": 29.927204132080078 }, { "src": "192.168.1.105", "sport": 49705, "dst": "162.159.61.3", "dport": 443, "offset": 496033, "time": 32.528746128082275 }, { "src": "192.168.1.105", "sport": 49707, "dst": "172.64.41.3", "dport": 443, "offset": 496175, "time": 32.531620025634766 }, { "src": "192.168.1.105", "sport": 49710, "dst": "8.8.4.4", "dport": 443, "offset": 496667, "time": 32.71525192260742 }, { "src": "192.168.1.105", "sport": 49804, "dst": "172.172.255.218", "dport": 443, "offset": 497042, "time": 35.25777196884155 }, { "src": "172.172.255.218", "sport": 443, "dst": "192.168.1.105", "dport": 49856, "offset": 506592, "time": 36.150696992874146 }, { "src": "192.168.1.105", "sport": 49724, "dst": "23.211.129.205", "dport": 443, "offset": 509303, "time": 36.383973121643066 }, { "src": "192.168.1.105", "sport": 49726, "dst": "23.216.106.59", "dport": 443, "offset": 509444, "time": 36.52230405807495 }, { "src": "192.168.1.105", "sport": 49725, "dst": "199.232.211.52", "dport": 443, "offset": 509585, "time": 37.51033592224121 }, { "src": "192.168.1.105", "sport": 49727, "dst": "23.211.129.205", "dport": 443, "offset": 520113, "time": 38.91786193847656 }, { "src": "192.168.1.105", "sport": 49809, "dst": "150.171.109.19", "dport": 443, "offset": 565405, "time": 40.58074712753296 }, { "src": "192.168.1.105", "sport": 49810, "dst": "162.159.128.235", "dport": 443, "offset": 579258, "time": 40.920637130737305 } ], "udp": [ { "src": "192.168.1.105", "sport": 61892, "dst": "8.8.8.8", "dport": 53, "offset": 567, "time": 0.4354851245880127 }, { "src": "192.168.1.105", "sport": 53558, "dst": "8.8.8.8", "dport": 53, "offset": 1329, "time": 0.7210779190063477 }, { "src": "192.168.1.105", "sport": 61795, "dst": "8.8.8.8", "dport": 53, "offset": 11136, "time": 0.8671491146087646 }, { "src": "192.168.1.105", "sport": 65173, "dst": "8.8.8.8", "dport": 53, "offset": 38016, "time": 2.077281951904297 }, { "src": "192.168.1.105", "sport": 51198, "dst": "8.8.8.8", "dport": 53, "offset": 41349, "time": 2.1538689136505127 }, { "src": "192.168.1.105", "sport": 138, "dst": "192.168.1.255", "dport": 138, "offset": 57963, "time": 4.0925209522247314 }, { "src": "192.168.1.105", "sport": 61870, "dst": "8.8.8.8", "dport": 53, "offset": 73985, "time": 10.629542112350464 }, { "src": "192.168.1.105", "sport": 56140, "dst": "8.8.8.8", "dport": 53, "offset": 74941, "time": 10.630697011947632 }, { "src": "192.168.1.105", "sport": 61603, "dst": "8.8.8.8", "dport": 53, "offset": 75123, "time": 10.634618043899536 }, { "src": "192.168.1.105", "sport": 60816, "dst": "8.8.8.8", "dport": 53, "offset": 75581, "time": 10.65080213546753 }, { "src": "192.168.1.105", "sport": 58031, "dst": "8.8.8.8", "dport": 53, "offset": 76774, "time": 10.658070087432861 }, { "src": "192.168.1.105", "sport": 54205, "dst": "185.247.139.200", "dport": 443, "offset": 77114, "time": 10.660300970077515 }, { "src": "192.168.1.105", "sport": 62937, "dst": "8.8.8.8", "dport": 53, "offset": 91882, "time": 10.679140090942383 }, { "src": "192.168.1.105", "sport": 59526, "dst": "8.8.8.8", "dport": 53, "offset": 96795, "time": 10.698475122451782 }, { "src": "192.168.1.105", "sport": 55258, "dst": "8.8.8.8", "dport": 53, "offset": 141991, "time": 10.843394994735718 }, { "src": "192.168.1.105", "sport": 63453, "dst": "8.8.8.8", "dport": 53, "offset": 174158, "time": 11.94168996810913 }, { "src": "192.168.1.105", "sport": 54968, "dst": "162.159.135.232", "dport": 443, "offset": 175908, "time": 11.973509073257446 }, { "src": "192.168.1.105", "sport": 52603, "dst": "8.8.8.8", "dport": 53, "offset": 204155, "time": 14.078490972518921 }, { "src": "192.168.1.105", "sport": 63067, "dst": "162.159.133.233", "dport": 443, "offset": 206307, "time": 14.106276035308838 }, { "src": "192.168.1.105", "sport": 49650, "dst": "8.8.8.8", "dport": 53, "offset": 248983, "time": 15.53049111366272 }, { "src": "192.168.1.105", "sport": 60319, "dst": "8.8.8.8", "dport": 53, "offset": 249170, "time": 15.532124996185303 }, { "src": "192.168.1.105", "sport": 50471, "dst": "8.8.8.8", "dport": 53, "offset": 249357, "time": 15.53322696685791 }, { "src": "192.168.1.105", "sport": 50514, "dst": "8.8.8.8", "dport": 53, "offset": 249544, "time": 15.53395414352417 }, { "src": "192.168.1.105", "sport": 58723, "dst": "8.8.8.8", "dport": 53, "offset": 249731, "time": 15.534584045410156 }, { "src": "192.168.1.105", "sport": 64379, "dst": "8.8.8.8", "dport": 53, "offset": 249918, "time": 15.53515100479126 }, { "src": "192.168.1.105", "sport": 57851, "dst": "172.64.41.3", "dport": 443, "offset": 254120, "time": 15.558589935302734 }, { "src": "192.168.1.105", "sport": 59162, "dst": "162.159.61.3", "dport": 443, "offset": 259956, "time": 15.562534093856812 }, { "src": "192.168.1.105", "sport": 56435, "dst": "8.8.8.8", "dport": 443, "offset": 373398, "time": 15.889539003372192 }, { "src": "192.168.1.105", "sport": 5353, "dst": "224.0.0.251", "dport": 5353, "offset": 416811, "time": 16.20543098449707 }, { "src": "192.168.1.105", "sport": 62103, "dst": "8.8.8.8", "dport": 53, "offset": 444578, "time": 18.95083498954773 }, { "src": "192.168.1.105", "sport": 59018, "dst": "8.8.8.8", "dport": 53, "offset": 480179, "time": 24.909464120864868 }, { "src": "192.168.1.105", "sport": 52692, "dst": "8.8.8.8", "dport": 53, "offset": 509825, "time": 38.44535303115845 }, { "src": "192.168.1.105", "sport": 60560, "dst": "23.56.110.169", "dport": 443, "offset": 509924, "time": 38.44589805603027 }, { "src": "192.168.1.105", "sport": 58486, "dst": "185.247.139.200", "dport": 443, "offset": 520254, "time": 39.45025992393494 }, { "src": "192.168.1.105", "sport": 50246, "dst": "8.8.8.8", "dport": 443, "offset": 540207, "time": 40.44328594207764 }, { "src": "192.168.1.105", "sport": 60857, "dst": "8.8.8.8", "dport": 53, "offset": 578523, "time": 40.87508797645569 }, { "src": "192.168.1.105", "sport": 57441, "dst": "23.56.110.169", "dport": 443, "offset": 593571, "time": 60.82068610191345 }, { "src": "192.168.1.105", "sport": 56065, "dst": "185.247.139.200", "dport": 443, "offset": 603306, "time": 65.82941102981567 } ], "icmp": [], "http": [ { "count": 1, "host": "steamconnecttest.com", "port": 80, "data": "GET /204 HTTP/1.1\r\nCache-Control: no-cache\r\nHost: steamconnecttest.com\r\nAccept: text/html,*/*;q=0.9\r\naccept-encoding: gzip,identity,*;q=0\r\naccept-charset: ISO-8859-1,utf-8,*;q=0.7\r\nuser-agent: Valve/Steam HTTP Client 1.0\r\n\r\n", "uri": "http://steamconnecttest.com/204", "body": "", "path": "/204", "user-agent": "Valve/Steam HTTP Client 1.0", "version": "1.1", "method": "GET", "first_seen": 1780003133.376879 }, { "count": 1, "host": "c.pki.goog", "port": 80, "data": "GET /r/r1.crl HTTP/1.1\r\nCache-Control: max-age = 3000\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT\r\nUser-Agent: Microsoft-CryptoAPI/10.0\r\nHost: c.pki.goog\r\n\r\n", "uri": "http://c.pki.goog/r/r1.crl", "body": "", "path": "/r/r1.crl", "user-agent": "Microsoft-CryptoAPI/10.0", "version": "1.1", "method": "GET", "first_seen": 1780003134.549524 } ], "dns": [ { "request": "api.steampowered.com", "type": "A", "answers": [ { "type": "A", "data": "23.216.106.59" } ], "first_seen": 1780003132.669406 }, { "request": "ipv6check-udp.steamserver.net", "type": "AAAA", "answers": [ { "type": "CNAME", "data": "udp.ipv6check.akadns.net" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d36" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d37" }, { "type": "AAAA", "data": "2404:3fc0:1:100::670a:7d06" }, { "type": "AAAA", "data": "2404:3fc0:1:100::42" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d38" }, { "type": "CNAME", "data": "syd.udp.ipv6check.akadns.net" }, { "type": "AAAA", "data": "2404:3fc0:1:100::670a:7d08" }, { "type": "AAAA", "data": "2404:3fc0:1:102::670a:7d35" }, { "type": "AAAA", "data": "2404:3fc0:1:100::32" } ], "first_seen": 1780003132.786729 }, { "request": "ipv6check-http.steamserver.net", "type": "A", "answers": [ { "type": "CNAME", "data": "http.ipv6check.akadns.net" }, { "type": "CNAME", "data": "syd.http.ipv6check.akadns.net" } ], "first_seen": 1780003132.99843 }, { "request": "steamconnecttest.com", "type": "A", "answers": [ { "type": "A", "data": "23.221.49.11" }, { "type": "A", "data": "23.221.49.17" } ], "first_seen": 1780003133.210775 }, { "request": "c.pki.goog", "type": "A", "answers": [ { "type": "CNAME", "data": "pki-goog.l.google.com" }, { "type": "A", "data": "142.250.195.131" } ], "first_seen": 1780003134.505113 }, { "request": "badoomovies.com", "type": "A", "answers": [ { "type": "A", "data": "185.247.139.200" } ], "first_seen": 1780003142.982076 }, { "request": "discordapp.com", "type": "A", "answers": [ { "type": "A", "data": "162.159.135.233" }, { "type": "A", "data": "162.159.134.233" }, { "type": "A", "data": "162.159.133.233" }, { "type": "A", "data": "162.159.129.233" }, { "type": "A", "data": "162.159.130.233" } ], "first_seen": 1780003143.002046 }, { "request": "gateway-us-east1-c.discord.gg", "type": "A", "answers": [ { "type": "A", "data": "162.159.130.234" }, { "type": "A", "data": "162.159.134.234" }, { "type": "A", "data": "162.159.135.234" }, { "type": "A", "data": "162.159.133.234" }, { "type": "A", "data": "162.159.136.234" } ], "first_seen": 1780003143.194639 }, { "request": "status.discord.com", "type": "A", "answers": [ { "type": "A", "data": "162.159.128.233" }, { "type": "A", "data": "162.159.138.232" }, { "type": "A", "data": "162.159.137.232" }, { "type": "A", "data": "162.159.135.232" }, { "type": "A", "data": "162.159.136.232" } ], "first_seen": 1780003144.292934 }, { "request": "cdn.discordapp.com", "type": "A", "answers": [], "first_seen": 1780003146.429176 }, { "request": "updates.discord.com", "type": "A", "answers": [], "first_seen": 1780003146.433258 }, { "request": "dns.google", "type": "A", "answers": [ { "type": "A", "data": "8.8.4.4" }, { "type": "A", "data": "8.8.8.8" } ], "first_seen": 1780003147.881735 }, { "request": "cmp1-sea1.steamserver.net", "type": "A", "answers": [ { "type": "A", "data": "205.196.6.132" } ], "first_seen": 1780003151.302079 }, { "request": "p2p-syd1.discovery.steamserver.net", "type": "A", "answers": [ { "type": "A", "data": "103.10.125.24" }, { "type": "A", "data": "103.10.125.42" } ], "first_seen": 1780003152.176419 }, { "request": "latency.discord.media", "type": "A", "answers": [ { "type": "A", "data": "162.159.130.235" }, { "type": "A", "data": "162.159.129.235" }, { "type": "A", "data": "162.159.138.234" }, { "type": "A", "data": "162.159.137.234" }, { "type": "A", "data": "162.159.128.235" } ], "first_seen": 1780003173.226212 } ], "smtp": [], "irc": [], "dead_hosts": [ [ "40.126.14.161", 443 ], [ "185.247.139.200", 443 ], [ "23.202.166.56", 443 ], [ "72.153.5.141", 443 ], [ "72.153.5.96", 443 ], [ "72.153.5.62", 443 ] ] }, "url": { "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n BADOOMOVIES.COM\nCreation Date:\n 2026-05-26 15:06:50\nUpdated Date:\n 2026-05-26 16:54:14\nExpiration Date:\n 2027-05-26 15:06:50\nEmail(s):\n abuse-tracker@hostinger.com\n\nRegistrar(s):\n HOSTINGER operations, UAB\nName Server(s):\n DNS23.HOSTWARE.COM.TR\n DNS24.HOSTWARE.COM.TR\nReferral URL(s):\n None", "virustotal": { "error": true, "msg": "Unable to complete connection to VirusTotal. Status code: 429" } }, "target": { "category": "url" }, "url_analysis": { "url": "https://badoomovies.com/download/BadooMovies.exe" }, "procmemory": [], "signatures": [ { "name": "stealth_network", "description": "Network activity detected but not expressed in monitor API logs", "categories": [ "stealth" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "ip": "150.171.109.19" }, { "ip": "199.232.211.52" }, { "ip": "23.211.129.205" }, { "ip": "146.75.119.82" }, { "ip": "205.196.6.132" }, { "ip": "162.254.195.69" }, { "ip": "162.254.195.75" }, { "ip": "103.10.125.22" }, { "ip": "23.216.106.59" }, { "ip": "23.56.110.169" }, { "ip": "162.159.128.235" }, { "ip": "162.159.138.232" }, { "ip": "162.159.135.232" }, { "ip": "162.159.133.234" }, { "ip": "162.159.135.233" }, { "ip": "185.247.139.200" }, { "ip": "162.159.133.233" }, { "ip": "162.159.135.234" }, { "ip": "142.250.195.131" }, { "ip": "23.221.49.11" }, { "ip": "172.172.255.218" }, { "ip": "199.232.215.52" }, { "ip": "103.10.125.23" }, { "domain": "api.steampowered.com" }, { "domain": "ipv6check-udp.steamserver.net" }, { "domain": "ipv6check-http.steamserver.net" }, { "domain": "steamconnecttest.com" }, { "domain": "c.pki.goog" }, { "domain": "badoomovies.com" }, { "domain": "discordapp.com" }, { "domain": "gateway-us-east1-c.discord.gg" }, { "domain": "status.discord.com" }, { "domain": "cdn.discordapp.com" }, { "domain": "updates.discord.com" }, { "domain": "dns.google" }, { "domain": "cmp1-sea1.steamserver.net" }, { "domain": "p2p-syd1.discovery.steamserver.net" }, { "domain": "latency.discord.media" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antidebug_setunhandledexceptionfilter", "description": "SetUnhandledExceptionFilter detected (possible anti-debug)", "categories": [ "anti-debug" ], "severity": 1, "weight": 1, "confidence": 40, "references": [], "data": [ { "type": "call", "pid": 8972, "cid": 165 } ], "new_data": [], "alert": false, "families": [] }, { "name": "language_check_registry", "description": "Checks system language via registry key (possible geofencing)", "categories": [ "location_discovery", "geofence" ], "severity": 1, "weight": 1, "confidence": 100, "references": [], "data": [ { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU" }, { "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU" } ], "new_data": [], "alert": false, "families": [] }, { "name": "privilege_elevation_check", "description": "Queries process token information to check for Administrator privileges or UAC elevation status", "categories": [ "discovery", "privilege_escalation" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 8972, "cid": 865 }, { "type": "call", "pid": 8972, "cid": 866 }, { "type": "call", "pid": 8972, "cid": 3619 }, { "type": "call", "pid": 8972, "cid": 3620 }, { "type": "call", "pid": 8972, "cid": 3945 }, { "type": "call", "pid": 8972, "cid": 4243 }, { "type": "call", "pid": 8972, "cid": 4244 } ], "new_data": [], "alert": false, "families": [] }, { "name": "query_fips_reconnaissance", "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software", "categories": [ "discovery", "c2" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 5232, "cid": 57 }, { "type": "call", "pid": 5232, "cid": 58 }, { "type": "call", "pid": 5232, "cid": 61 }, { "type": "call", "pid": 5232, "cid": 63 }, { "type": "call", "pid": 5232, "cid": 64 }, { "behavioral_fips_reconnaissance": [ "SecurityHealthHost.exe (PID: 5232) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "SecurityHealthHost.exe (PID: 5232) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "SecurityHealthHost.exe (PID: 5232) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 5232) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 5232) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'" ] } ], "new_data": [], "alert": false, "families": [] }, { "name": "mountpoints_volume_discovery", "description": "Queries the mount points and then resolves volume paths to enumerate storage devices", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "type": "call", "pid": 8972, "cid": 3826 }, { "type": "call", "pid": 8972, "cid": 3831 }, { "type": "call", "pid": 8972, "cid": 3844 }, { "type": "call", "pid": 8972, "cid": 3873 }, { "type": "call", "pid": 8972, "cid": 3875 }, { "type": "call", "pid": 8972, "cid": 3882 }, { "type": "call", "pid": 8972, "cid": 3899 }, { "type": "call", "pid": 8972, "cid": 3908 }, { "type": "call", "pid": 8972, "cid": 3912 }, { "type": "call", "pid": 8972, "cid": 3919 } ], "new_data": [], "alert": false, "families": [] }, { "name": "dllload_suspicious_directory", "description": "A DLL was loaded from a suspicious directory", "categories": [ "side loading" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 4132, "cid": 123 }, { "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking" }, { "type": "call", "pid": 4132, "cid": 126 }, { "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking" } ], "new_data": [], "alert": false, "families": [] }, { "name": "registers_vectored_exception_handler", "description": "Registers a vectored exception handler (VEH), possibly to hijack execution flow", "categories": [ "evasion", "execution", "injection" ], "severity": 2, "weight": 1, "confidence": 80, "references": [], "data": [ { "type": "call", "pid": 8972, "cid": 166 } ], "new_data": [], "alert": false, "families": [] }, { "name": "creates_suspended_process", "description": "Creates a process in a suspended state, likely for injection", "categories": [ "injection", "process hollowing" ], "severity": 2, "weight": 1, "confidence": 50, "references": [], "data": [ { "type": "call", "pid": 4132, "cid": 102 }, { "type": "call", "pid": 4132, "cid": 106 }, { "type": "call", "pid": 4132, "cid": 119 }, { "type": "call", "pid": 4132, "cid": 120 }, { "type": "call", "pid": 4132, "cid": 140 }, { "type": "call", "pid": 4132, "cid": 141 }, { "type": "call", "pid": 4132, "cid": 173 }, { "type": "call", "pid": 4132, "cid": 175 }, { "type": "call", "pid": 4132, "cid": 180 }, { "type": "call", "pid": 4132, "cid": 186 }, { "type": "call", "pid": 832, "cid": 73 }, { "type": "call", "pid": 832, "cid": 84 }, { "type": "call", "pid": 832, "cid": 117 } ], "new_data": [], "alert": false, "families": [] }, { "name": "resumethread_remote_process", "description": "Resumed a thread in another process", "categories": [ "injection", "unpacking" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "thread_resumed": "Process svchost.exe with process ID 832 resumed a thread in another process with the process ID 8504" }, { "type": "call", "pid": 832, "cid": 74 } ], "new_data": [], "alert": false, "families": [] }, { "name": "terminates_remote_process", "description": "Terminates another process", "categories": [ "persistence", "stealth" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "type": "call", "pid": 832, "cid": 88 }, { "process": "svchost.exe" } ], "new_data": [], "alert": false, "families": [] }, { "name": "discover_registry_mount_points", "description": "Queries registry mount points to identify historical or connected removable/network drives", "categories": [ "discovery", "ransomware", "wiper" ], "severity": 2, "weight": 1, "confidence": 20, "references": [], "data": [ { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\" }, { "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data" } ], "new_data": [], "alert": false, "families": [] }, { "name": "suspicious_tld", "description": "Resolves a suspicious Top Level Domain (TLD)", "categories": [ "network" ], "severity": 2, "weight": 1, "confidence": 100, "references": [], "data": [ { "domain": "latency.discord.media" } ], "new_data": [], "alert": false, "families": [] }, { "name": "antisandbox_unhook", "description": "Tries to unhook or modify Windows functions monitored by CAPE", "categories": [ "anti-sandbox" ], "severity": 3, "weight": 1, "confidence": 60, "references": [], "data": [ { "type": "call", "pid": 8972, "cid": 2327 }, { "unhook": "function_name: CommandLineToArgvW, type: restored" } ], "new_data": [], "alert": false, "families": [] } ], "malscore": 8.9, "ttps": [ { "signature": "stealth_network", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "antisandbox_unhook", "ttps": [ "T1562.001", "T1562" ], "mbcs": [ "OB0001", "B0003", "OB0006", "F0004", "F0004.003" ] }, { "signature": "privilege_elevation_check", "ttps": [ "T1033", "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "query_fips_reconnaissance", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "mountpoints_volume_discovery", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "dllload_suspicious_directory", "ttps": [ "T1574" ], "mbcs": [ "F0015" ] }, { "signature": "registers_vectored_exception_handler", "ttps": [ "T1055", "T1574" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "creates_suspended_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "resumethread_remote_process", "ttps": [ "T1055" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "terminates_remote_process", "ttps": [ "T1071" ], "mbcs": [ "C0018" ] }, { "signature": "discover_registry_mount_points", "ttps": [ "T1082" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] }, { "signature": "suspicious_tld", "ttps": [ "T1071" ], "mbcs": [ "OC0006", "C0002", "OC0006", "C0002" ] } ], "malstatus": "Malicious" }